Re: [netsniff-ng] multiple instances of netsniff-ng with AF_PACKET hash fanout
Hi all, The qm won't work in your case since your kernel is too old $ uname -a Linux 3.2.0-74-generic #109-Ubuntu SMP Tue Dec 9 16:45:49 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux Do I need newer kernel ? 3.2.0-82-generic is available. The only issue (as I don't know what traffic you're seeing) could be that your rxhash always falls into fanout member with that prefix, strange. I would need to run more isolated test because I capture gigabytes of data, but I can tell by size of capture files that I don't get all data since my 1 minute files are lot smaller than single file I get when capturing w/o fanout feature. Does the above example work for you on loopback? If you have two instances in the same group outputting to a normal pcap file with rnd, do you both files get written? For rnd and qm, I get Cannot set fanout ring mode! when trying to use Lo or physical NIC eth5 in my case. For hash mode results in only last instance file being written. Tried lo and eth5. Also, tried group 1 and 2 just in case. Let me know if I can provide any additional details. Regards Ivan -- You received this message because you are subscribed to the Google Groups netsniff-ng group. To unsubscribe from this group and stop receiving emails from it, send an email to netsniff-ng+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
Re: [netsniff-ng] multiple instances of netsniff-ng with AF_PACKET hash fanout
On Thursday, May 7, 2015 at 11:40:02 AM UTC-5, Daniel Borkmann wrote: On 05/07/2015 06:22 PM, arse...@gmail.com wrote: ... I didn't see much difference in lb vs hash mode when it comes to output file sizes and CPU utilization, but let me know if one has advantage over the other in some form or fashion. It probably depends on what you want. ;) So from the fanout demuxing disciplines (lb vs hash vs cpu) themselves, cpu seems to be the most lightweight (haven't measured them yet), i.e. it's just a cpu % fanout-group-size. With lb, you obviously need synchronization with regards to demuxing to a group member (that is, 2 atomic reads, 1 atomic cmpxchg) and with fanout hash, worst case you have to go into the kernel flow dissector to pick up flow keys to generate a l4 hash to demux over. If you can distribute the load via RSS and the use cpu, or on newer kernels, qm, then that's probably most lightweight. hash or a combination with RSS and cpu/qm, I find useful since it allows flows to stay pcap-local unlike lb. Cheers, Daniel Hi Daniel, sounds good. I will try distributed load via RSS and fanout cpu, and on some machines which for some reason keep hitting just one IRQ ( I have myricom 10G card configured with myri10ge_max_slices=8 but Rx keeps hitting just one IRQ all the time), will try to go for hash rather than lb. Regards Ivan -- You received this message because you are subscribed to the Google Groups netsniff-ng group. To unsubscribe from this group and stop receiving emails from it, send an email to netsniff-ng+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
Re: [netsniff-ng] multiple instances of netsniff-ng with AF_PACKET hash fanout
On 05/07/2015 02:32 AM, Michał Purzyński wrote: I used 3.13 for testing. It's in Ubuntu as HWE stack. So, following commit was added v3.0-rc4-846-gdc99f60 ... commit dc99f600698dcac69b8f56dda9a8a00d645c5ffc Author: David S. Miller da...@davemloft.net Date: Tue Jul 5 01:45:05 2011 -0700 packet: Add fanout support. ... but would be great if you have the chance to try something more recent as Michal pointed out. On May 7, 2015 2:29 AM, arse...@gmail.com wrote: Hi all, The qm won't work in your case since your kernel is too old $ uname -a Linux 3.2.0-74-generic #109-Ubuntu SMP Tue Dec 9 16:45:49 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux Do I need newer kernel ? 3.2.0-82-generic is available. The only issue (as I don't know what traffic you're seeing) could be that your rxhash always falls into fanout member with that prefix, strange. I would need to run more isolated test because I capture gigabytes of data, but I can tell by size of capture files that I don't get all data since my 1 minute files are lot smaller than single file I get when capturing w/o fanout feature. Does the above example work for you on loopback? If you have two instances in the same group outputting to a normal pcap file with rnd, do you both files get written? For rnd and qm, I get Cannot set fanout ring mode! when trying to use Lo or physical NIC eth5 in my case. Ok, I see. Since your kernel doesn't support that. For hash mode results in only last instance file being written. Tried lo and eth5. And that does also happen for rr/lb mode (round robin), right? Even if you remove the --out and --silent, etc? One terminal: netsniff-ng --fanout-group 1 --fanout-type rr --in lo Another: netsniff-ng --fanout-group 1 --fanout-type rr --in lo And then ping 127.0.0.1 ? In any case, I'd recommend trying out a newer kernel (yours is roughly 4 years old). Cheers, Daniel -- You received this message because you are subscribed to the Google Groups netsniff-ng group. To unsubscribe from this group and stop receiving emails from it, send an email to netsniff-ng+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[netsniff-ng] [PATCH] authors: Fix Daniel's email
From: Vadim Kochan vadi...@gmail.com Use actual Daniel's borkm...@iogearbox.net email. Signed-off-by: Vadim Kochan vadi...@gmail.com --- AUTHORS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AUTHORS b/AUTHORS index ec95d91..f9471db 100644 --- a/AUTHORS +++ b/AUTHORS @@ -1,7 +1,7 @@ Maintainer: * Tobias Klauser tklau...@distanz.ch - * Daniel Borkmann borkm...@redhat.com + * Daniel Borkmann borkm...@iogearbox.net Former maintainer: -- 2.3.1 -- You received this message because you are subscribed to the Google Groups netsniff-ng group. To unsubscribe from this group and stop receiving emails from it, send an email to netsniff-ng+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
Re: [netsniff-ng] multiple instances of netsniff-ng with AF_PACKET hash fanout
On 05/07/2015 04:47 PM, arse...@gmail.com wrote: ... I am very sorry but it looks like this was working all the time at least in couple of modes but I messed up ls command and didn't see other files ! Ok, no problem. It's good that we now have it verified from a couple of people that it works fine. :)) Cheers thanks, Daniel -- You received this message because you are subscribed to the Google Groups netsniff-ng group. To unsubscribe from this group and stop receiving emails from it, send an email to netsniff-ng+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
Re: [netsniff-ng] multiple instances of netsniff-ng with AF_PACKET hash fanout
Daniel, is there any difference or advantage between lb/hash vs cpu mode ? If I use affinity to lock let's say my 4 Rx queues to CPUs 2,4,6,8, would most efficient way of running netsniff-ng be to run fanout-type cpu and bind 4 instances to CPUs 10,12,14,16 ( assuming these 8 cores are on 1 physical CPU ) or it doesn't really matter ? I didn't see much difference in lb vs hash mode when it comes to output file sizes and CPU utilization, but let me know if one has advantage over the other in some form or fashion. Regards Ivan -- You received this message because you are subscribed to the Google Groups netsniff-ng group. To unsubscribe from this group and stop receiving emails from it, send an email to netsniff-ng+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
