Hi Marco, As you're using RSS with 4 queues, you are balancing the incoming traffic among 4 queues.
In order to monitor every single queue in ntopng, you have to explicitly tell it to monitor these 4 queues. So you should do -i="zc:ens2@0" -i="zc:ens2@1" -i="zc:ens2@2" -i="zc:ens2@3" Your current -i=ens2 is defaulting to queue number 0 and isn't using the Zero Copy driver. The use of zc: will reduce/eliminate the drops. Note that you can also play with core affinity (see --core-affinity) to make sure ntopng pins the 4 capturing threads spawned to certain cores that you want. Finally, if you want to merge the 4 interfaces in a single view, you can add an extra -i="view:zc:ens2@0,zc:ens2@1,zc:ens2@2,zc:ens2@3" Don't worry, the view won't put extra pressure on the machine. Regards, Simone > On 4 Feb 2019, at 12:29, Marco Pirovano <[email protected]> wrote: > > Hello, > > we are using NTOPNG to monitor our 10G link to internet. > We are using an Arista switch in Tap Aggregation mode to send traffic to > NTOPNG server. > > The traffic is about 2Gbps and we see several dropped packets: > > Received Traffic 157.47 GB [292,586,873 Pkts] Dropped Packets > 25,637,433 Pkts [ 8.06 % ] > > I've configured PF_RING ZC, the interface is an Intel 82599, ixgbe driver. > > ixgbe.conf configuration: RSS=4,4,4,4 > > pf_fing.conf configuration: min_num_slots=65536 > > ntopng.conf configuratrion: > > # > -i=ens2 > # > -w=3000 > # > -m=10.0.0.0/8,193.205.23.0/24 > # > -n=1 > # > -d=/var/lib/ntopng > # > -x=150000 > # > -X=1000000 > # > > > What do I need to setup correctly to see less dropped packets ? > > Thank you very much. > Marco > > -- > Marco Pirovano > Security & Network Competence Centre > ICT - Universita' Bocconi > via Gobbi, 5 - 20136 Milano > Tel. +39 02 5836.3173 > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
