Hi Chandrika in PF_RING we rely on kernel defragmentation routines, it’s not our code. As the kernel code is designed to work per socket and not in in the wild, this could be the issue. I suggest to defragment in user-space as your traffic seems to be heavily fragmented (BTW why don’t you increase the MTU?)
Luca > On 9 Nov 2016, at 08:20, Chandrika Gautam <chandrika.iitd.r...@gmail.com> > wrote: > > Hi Alfredo, > > Let me rephrase the problem I am facing some problem when fragmentation is > enabled in PFRING. > > Please find the attachment trace where there are total 18 fragmented > packets(9 complete packets), out of which PFRING is assembling only 1. > > These packets having some padding bytes which PFRING seems not able to decode > and assemble correctly. > > Regards, > Chandrika > > On Thu, Nov 3, 2016 at 2:34 PM, Alfredo Cardigliano <cardigli...@ntop.org > <mailto:cardigli...@ntop.org>> wrote: > Hi Chandrika > a few quesitons: > - are you talking about defragmentation? > - what do you mean with "callback”? > - what drivers are you using? > Please note that in case of defragmentation, the pf_ring kernel module is > using the linux ip_defrag() functionality. > > Alfredo > > > On 3 Nov 2016, at 06:36, Chandrika Gautam <chandrika.iitd.r...@gmail.com > > <mailto:chandrika.iitd.r...@gmail.com>> wrote: > > > > Hi, > > > > I am using PFRING 6.2.0 and enabled fragmentation in PFRING but PFRING is > > not giving a callback on the attached packets having two fragments (first > > fragment is smaller and latter one is bigger). > > Can you please help us to understand how does fragmentation work in PFRING. > > > > How many simultaneous ip fragments it can cater(hash size) and what is the > > timeout for fragments? > > > > Regards, > > C.G. > > <fragments_testcase2_orig.pcap>_______________________________________________ > > Ntop-misc mailing list > > Ntop-misc@listgateway.unipi.it <mailto:Ntop-misc@listgateway.unipi.it> > > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > > <http://listgateway.unipi.it/mailman/listinfo/ntop-misc> > > _______________________________________________ > Ntop-misc mailing list > Ntop-misc@listgateway.unipi.it <mailto:Ntop-misc@listgateway.unipi.it> > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > <http://listgateway.unipi.it/mailman/listinfo/ntop-misc> > <docomo_fragments_2_case_loss_1.pcap>_______________________________________________ > Ntop-misc mailing list > Ntop-misc@listgateway.unipi.it > http://listgateway.unipi.it/mailman/listinfo/ntop-misc
_______________________________________________ Ntop-misc mailing list Ntop-misc@listgateway.unipi.it http://listgateway.unipi.it/mailman/listinfo/ntop-misc
