date:20180125

Re: [Ntop-misc] About pf_ring licences (was nProbe Pro won't do more then 1Gb/s?)

2018-01-25 Thread Luca Deri

Marco
I suggest you to start reading the PF_RING articles on our blog as the 
discussion is pretty long. First of all think in terms of pps and not Gbps, 
then consider the configuration of nprobe, the nature of traffic (fragments?) 
etc. Packet capture is just one component 

Luca

> On 25 Jan 2018, at 21:54, Marco Teixeira  wrote:
> 
> Ok. And one can expect to reach more than 1Gb/s on vanilla drivers right? On 
> a somewhat decent server... Xeon with PCIe x8 NIC...
> 
> Regards
> Marco
> 
> 
> 
> 2018-01-25 19:52 GMT+00:00 Luca Deri >:
> 
> 
>> On 25 Jan 2018, at 20:29, Marco Teixeira > > wrote:
>> 
>> Hi Luca,
>> 
>> I have the details and was going to generate de license fo 10Gb/s... but I 
>> was expecting an option for "Standard NIC" and only see Intel, Myricom and 
>> Napatech/DAG/Fiberblaze...
>> Wich one should I choose to make for my "Standard NIC" that uses PF_RING in 
>> NAPI mode? 
>> Or maybe there was some misunderstanding here?
> Yes there is some disconnection Marco
> 
> You only need a license for ZC drivers, otherwise you will use vanilla 
> drivers. So pfcount -i zc:ens2f0 requires a ZC drivers,  pfcount -i ens2f0 
> does not
> 
> Please see https://github.com/ntop/PF_RING/wiki 
>  for details
> 
> Regards Luca
> 
>> 
>> Regards, and thank you for your advice, and time, 
>> Marco
>> 
>> 
>> 
>> 
>> 2018-01-25 12:05 GMT+00:00 Luca Deri >:
>> Marco
>> our licenses don’t have a cap on speed, but they are per device family. So 
>> if these devices as 10G you need a 10G license
>> 
>> As you’re a university you can mail educat...@ntop.org 
>>  for free licenses
>> 
>> Regards Luca
>> 
>> 
>>> On 25 Jan 2018, at 12:52, Marco Teixeira >> > wrote:
>>> 
>>> Hello,
>>> 
>>> Regarding the output below, does one need a license to be able to run 
>>> 10Gb/s speeds (please mind, I'm only talking about pf_ring. nprobe is 
>>> already licensed with "enterprise pro")?
>>> 
>>> 
>>> ===
>>> [marco@nprobe ~]$ sudo pfcount -L -v1 | grep ens2f
>>> NameSystemName  Module  MAC BusID   
>>> NumaNodeStatus  License
>>> ens2f0  ens2f0  pf_ring D8:D3:85:A0:12:50   :13:00.0-1  
>>> Up  NotFound
>>> ens2f1  ens2f1  pf_ring D8:D3:85:A0:12:54   :13:00.1-1  
>>> DownNotFound
>>> [marco@nprobe ~]$ 
>>> [marco@nprobe ~]$ cat /proc/net/pf_ring/dev/ens2f0/info 
>>> Name: ens2f0
>>> Index:6
>>> Address:  D8:D3:85:A0:12:50
>>> Polling Mode: NAPI
>>> Type: Ethernet
>>> Family:   Standard NIC
>>> # Bound Sockets:  1
>>> TX Queues:1
>>> RX Queues:1
>>> ===
>>> 
>>> 
>>> Regards,
>>> Marco
>>> 
>>> 
>>> 2018-01-18 10:35 GMT+00:00 Marco Teixeira >> >:
>>> Hi Afredo and anyone "listening",
>>> 
>>> I would like to rule out if pf_ring is the culprit here...
>>> What would be the correct way to have nprobe use libpcap (or AF_PACKET??) 
>>> mode of getting packets from the NIC?
>>> Blacklisting pf_ring module from loading?
>>> 
>>> Thank you
>>> Marco
>>> 
>>> 
>>> 
>>> 
>>> 2018-01-17 22:16 GMT+00:00 Alfredo Cardigliano >> >:
>>> “Absolute Stats” is the total / average number of packets/bytes
>>> “Actual Stats” is the current number of packets/bytes (last second)
>>> 
>>> Alfredo
>>> 
 On 17 Jan 2018, at 21:13, Marco Teixeira > wrote:
 
 Hello list,
 
 Any PFRING wizard that can offer clues on where to start troubleshooting 
 this variance between "Absolut Stats" vs "Actual Stats"...?
 
 ===
 [marco@nprobe ~]$ sudo pfcount -i ens2f0 
 [sudo] password for marco: 
 Using PF_RING v.7.0.0
 Capturing from ens2f0 [mac: D8:D3:85:A0:12:50][if_index: 5][speed: 
 1Mb/s]
 # Device RX channels: 1
 # Polling threads:1
 Dumping statistics on /proc/net/pf_ring/stats/3096-ens2f0.3
 =
 Absolute Stats: [136'980 pkts total][0 pkts dropped][0.0% dropped]
 [136'980 pkts rcvd][126'559'478 bytes rcvd]
 =
 
 =
 Absolute Stats: [274'202 pkts total][0 pkts dropped][0.0% dropped]
 [274'202 pkts rcvd][254'708'653 bytes rcvd][274'163.89 pkt/sec][2'037.38 
 Mbit/sec]
 =
 Actual Stats: [137'222 pkts rcvd][1'000.13 ms][137'202.92 pps][1.03 Gbps]
 =
 
 =
 Absolute Stats: [411'199 pkts total][0 pkts dropped][0.0% dropped]
 [411'199 pkts rcvd][382'383'683 bytes rcvd][205'575.03 pkt/sec][1'529.35

Re: [Ntop-misc] About pf_ring licences (was nProbe Pro won't do more then 1Gb/s?)

2018-01-25 Thread Marco Teixeira

Ok. And one can expect to reach more than 1Gb/s on vanilla drivers right?
On a somewhat decent server... Xeon with PCIe x8 NIC...

Regards
Marco



2018-01-25 19:52 GMT+00:00 Luca Deri :

>
>
> On 25 Jan 2018, at 20:29, Marco Teixeira  wrote:
>
> Hi Luca,
>
> I have the details and was going to generate de license fo 10Gb/s... but I
> was expecting an option for "Standard NIC" and only see Intel, Myricom and
> Napatech/DAG/Fiberblaze...
> Wich one should I choose to make for my "Standard NIC" that uses PF_RING
> in NAPI mode?
> Or maybe there was some misunderstanding here?
>
> Yes there is some disconnection Marco
>
> You only need a license for ZC drivers, otherwise you will use vanilla
> drivers. So pfcount -i zc:ens2f0 requires a ZC drivers,  pfcount -i ens2f0
> does not
>
> Please see https://github.com/ntop/PF_RING/wiki for details
>
> Regards Luca
>
>
> Regards, and thank you for your advice, and time,
> Marco
>
>
>
> 2018-01-25 12:05 GMT+00:00 Luca Deri :
>
>> Marco
>> our licenses don’t have a cap on speed, but they are per device family.
>> So if these devices as 10G you need a 10G license
>>
>> As you’re a university you can mail educat...@ntop.org for free licenses
>>
>> Regards Luca
>>
>>
>> On 25 Jan 2018, at 12:52, Marco Teixeira  wrote:
>>
>> Hello,
>>
>> Regarding the output below, does one need a license to be able to run
>> 10Gb/s speeds (please mind, I'm only talking about pf_ring. nprobe is
>> already licensed with "enterprise pro")?
>>
>>
>> ===
>> [marco@nprobe ~]$ sudo pfcount -L -v1 | grep ens2f
>> NameSystemName  Module  MAC BusID
>>  NumaNodeStatus  License
>> ens2f0  ens2f0  pf_ring D8:D3:85:A0:12:50   :13:00.0
>> -1  Up  NotFound
>> ens2f1  ens2f1  pf_ring D8:D3:85:A0:12:54   :13:00.1
>> -1  DownNotFound
>> [marco@nprobe ~]$
>> [marco@nprobe ~]$ cat /proc/net/pf_ring/dev/ens2f0/info
>> Name: ens2f0
>> Index:6
>> Address:  D8:D3:85:A0:12:50
>> Polling Mode: NAPI
>> Type: Ethernet
>> Family:   Standard NIC
>> # Bound Sockets:  1
>> TX Queues:1
>> RX Queues:1
>> ===
>> 
>>
>>
>> Regards,
>> Marco
>>
>>
>>
>> 2018-01-18 10:35 GMT+00:00 Marco Teixeira :
>>
>>> Hi Afredo and anyone "listening",
>>>
>>> I would like to rule out if pf_ring is the culprit here...
>>> What would be the correct way to have nprobe use libpcap (or
>>> AF_PACKET??) mode of getting packets from the NIC?
>>> Blacklisting pf_ring module from loading?
>>>
>>> Thank you
>>> Marco
>>>
>>>
>>>
>>> 2018-01-17 22:16 GMT+00:00 Alfredo Cardigliano :
>>>
 “Absolute Stats” is the total / average number of packets/bytes
 “Actual Stats” is the current number of packets/bytes (last second)

 Alfredo

 On 17 Jan 2018, at 21:13, Marco Teixeira  wrote:

 Hello list,

 Any PFRING wizard that can offer clues on where to start
 troubleshooting this variance between "Absolut Stats" vs "Actual Stats"...?

 
 ===
 [marco@nprobe ~]$ sudo pfcount -i ens2f0
 [sudo] password for marco:
 Using PF_RING v.7.0.0
 Capturing from ens2f0 [mac: D8:D3:85:A0:12:50][if_index: 5][speed:
 1Mb/s]
 # Device RX channels: 1
 # Polling threads:1
 Dumping statistics on /proc/net/pf_ring/stats/3096-ens2f0.3
 =
 Absolute Stats: [136'980 pkts total][0 pkts dropped][0.0% dropped]
 [136'980 pkts rcvd][126'559'478 bytes rcvd]
 =

 =
 Absolute Stats: [274'202 pkts total][0 pkts dropped][0.0% dropped]
 [274'202 pkts rcvd][254'708'653 bytes rcvd][274'163.89
 pkt/sec][2'037.38 Mbit/sec]
 =
 Actual Stats: [137'222 pkts rcvd][1'000.13 ms][137'202.92 pps][1.03
 Gbps]
 =

 =
 Absolute Stats: [411'199 pkts total][0 pkts dropped][0.0% dropped]
 [411'199 pkts rcvd][382'383'683 bytes rcvd][205'575.03
 pkt/sec][1'529.35 Mbit/sec]
 =
 Actual Stats: [136'997 pkts rcvd][1'000.09 ms][136'983.43 pps][1.02
 Gbps]
 =
 ===

 Thankx
 Marco
 ___
 Ntop-misc mailing list
 Ntop-misc@listgateway.unipi.it
 http://listgateway.unipi.it/mailman/listinfo/ntop-misc



>>>
>> ___
>> Ntop-misc mailing list
>> Ntop-misc@listgateway.unipi.it
>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>
>>
>>
>> ___
>> Ntop-misc mailing list
>> Ntop-misc@listgateway.unipi.it
>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>
>
>

Re: [Ntop-misc] About pf_ring licences (was nProbe Pro won't do more then 1Gb/s?)

2018-01-25 Thread Luca Deri



> On 25 Jan 2018, at 20:29, Marco Teixeira  wrote:
> 
> Hi Luca,
> 
> I have the details and was going to generate de license fo 10Gb/s... but I 
> was expecting an option for "Standard NIC" and only see Intel, Myricom and 
> Napatech/DAG/Fiberblaze...
> Wich one should I choose to make for my "Standard NIC" that uses PF_RING in 
> NAPI mode? 
> Or maybe there was some misunderstanding here?
Yes there is some disconnection Marco

You only need a license for ZC drivers, otherwise you will use vanilla drivers. 
So pfcount -i zc:ens2f0 requires a ZC drivers,  pfcount -i ens2f0 does not

Please see https://github.com/ntop/PF_RING/wiki 
 for details

Regards Luca
> 
> Regards, and thank you for your advice, and time, 
> Marco
> 
> 
> 
> 
> 2018-01-25 12:05 GMT+00:00 Luca Deri >:
> Marco
> our licenses don’t have a cap on speed, but they are per device family. So if 
> these devices as 10G you need a 10G license
> 
> As you’re a university you can mail educat...@ntop.org 
>  for free licenses
> 
> Regards Luca
> 
> 
>> On 25 Jan 2018, at 12:52, Marco Teixeira > > wrote:
>> 
>> Hello,
>> 
>> Regarding the output below, does one need a license to be able to run 10Gb/s 
>> speeds (please mind, I'm only talking about pf_ring. nprobe is already 
>> licensed with "enterprise pro")?
>> 
>> 
>> ===
>> [marco@nprobe ~]$ sudo pfcount -L -v1 | grep ens2f
>> NameSystemName  Module  MAC BusID   
>> NumaNodeStatus  License
>> ens2f0  ens2f0  pf_ring D8:D3:85:A0:12:50   :13:00.0-1   
>>Up  NotFound
>> ens2f1  ens2f1  pf_ring D8:D3:85:A0:12:54   :13:00.1-1   
>>DownNotFound
>> [marco@nprobe ~]$ 
>> [marco@nprobe ~]$ cat /proc/net/pf_ring/dev/ens2f0/info 
>> Name: ens2f0
>> Index:6
>> Address:  D8:D3:85:A0:12:50
>> Polling Mode: NAPI
>> Type: Ethernet
>> Family:   Standard NIC
>> # Bound Sockets:  1
>> TX Queues:1
>> RX Queues:1
>> ===
>> 
>> 
>> Regards,
>> Marco
>> 
>> 
>> 2018-01-18 10:35 GMT+00:00 Marco Teixeira > >:
>> Hi Afredo and anyone "listening",
>> 
>> I would like to rule out if pf_ring is the culprit here...
>> What would be the correct way to have nprobe use libpcap (or AF_PACKET??) 
>> mode of getting packets from the NIC?
>> Blacklisting pf_ring module from loading?
>> 
>> Thank you
>> Marco
>> 
>> 
>> 
>> 
>> 2018-01-17 22:16 GMT+00:00 Alfredo Cardigliano > >:
>> “Absolute Stats” is the total / average number of packets/bytes
>> “Actual Stats” is the current number of packets/bytes (last second)
>> 
>> Alfredo
>> 
>>> On 17 Jan 2018, at 21:13, Marco Teixeira >> > wrote:
>>> 
>>> Hello list,
>>> 
>>> Any PFRING wizard that can offer clues on where to start troubleshooting 
>>> this variance between "Absolut Stats" vs "Actual Stats"...?
>>> 
>>> ===
>>> [marco@nprobe ~]$ sudo pfcount -i ens2f0 
>>> [sudo] password for marco: 
>>> Using PF_RING v.7.0.0
>>> Capturing from ens2f0 [mac: D8:D3:85:A0:12:50][if_index: 5][speed: 
>>> 1Mb/s]
>>> # Device RX channels: 1
>>> # Polling threads:1
>>> Dumping statistics on /proc/net/pf_ring/stats/3096-ens2f0.3
>>> =
>>> Absolute Stats: [136'980 pkts total][0 pkts dropped][0.0% dropped]
>>> [136'980 pkts rcvd][126'559'478 bytes rcvd]
>>> =
>>> 
>>> =
>>> Absolute Stats: [274'202 pkts total][0 pkts dropped][0.0% dropped]
>>> [274'202 pkts rcvd][254'708'653 bytes rcvd][274'163.89 pkt/sec][2'037.38 
>>> Mbit/sec]
>>> =
>>> Actual Stats: [137'222 pkts rcvd][1'000.13 ms][137'202.92 pps][1.03 Gbps]
>>> =
>>> 
>>> =
>>> Absolute Stats: [411'199 pkts total][0 pkts dropped][0.0% dropped]
>>> [411'199 pkts rcvd][382'383'683 bytes rcvd][205'575.03 pkt/sec][1'529.35 
>>> Mbit/sec]
>>> =
>>> Actual Stats: [136'997 pkts rcvd][1'000.09 ms][136'983.43 pps][1.02 Gbps]
>>> =
>>> ===
>>> 
>>> Thankx
>>> Marco
>>> ___
>>> Ntop-misc mailing list
>>> Ntop-misc@listgateway.unipi.it 
>>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc 
>>> 
>> 
>> 
>> ___
>> Ntop-misc mailing list
>> Ntop-misc@listgateway.unipi.it 
>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc 
>> 
> 
> ___
>

Re: [Ntop-misc] About pf_ring licences (was nProbe Pro won't do more then 1Gb/s?)

2018-01-25 Thread Marco Teixeira

Hi Luca,

I have the details and was going to generate de license fo 10Gb/s... but I
was expecting an option for "Standard NIC" and only see Intel, Myricom and
Napatech/DAG/Fiberblaze...
Wich one should I choose to make for my "Standard NIC" that uses PF_RING in
NAPI mode?
Or maybe there was some misunderstanding here?

Regards, and thank you for your advice, and time,
Marco



2018-01-25 12:05 GMT+00:00 Luca Deri :

> Marco
> our licenses don’t have a cap on speed, but they are per device family. So
> if these devices as 10G you need a 10G license
>
> As you’re a university you can mail educat...@ntop.org for free licenses
>
> Regards Luca
>
>
> On 25 Jan 2018, at 12:52, Marco Teixeira  wrote:
>
> Hello,
>
> Regarding the output below, does one need a license to be able to run
> 10Gb/s speeds (please mind, I'm only talking about pf_ring. nprobe is
> already licensed with "enterprise pro")?
>
>
> ===
> [marco@nprobe ~]$ sudo pfcount -L -v1 | grep ens2f
> NameSystemName  Module  MAC BusID
>  NumaNodeStatus  License
> ens2f0  ens2f0  pf_ring D8:D3:85:A0:12:50   :13:00.0
> -1  Up  NotFound
> ens2f1  ens2f1  pf_ring D8:D3:85:A0:12:54   :13:00.1
> -1  DownNotFound
> [marco@nprobe ~]$
> [marco@nprobe ~]$ cat /proc/net/pf_ring/dev/ens2f0/info
> Name: ens2f0
> Index:6
> Address:  D8:D3:85:A0:12:50
> Polling Mode: NAPI
> Type: Ethernet
> Family:   Standard NIC
> # Bound Sockets:  1
> TX Queues:1
> RX Queues:1
> ===
> 
>
>
> Regards,
> Marco
>
>
>
> 2018-01-18 10:35 GMT+00:00 Marco Teixeira :
>
>> Hi Afredo and anyone "listening",
>>
>> I would like to rule out if pf_ring is the culprit here...
>> What would be the correct way to have nprobe use libpcap (or AF_PACKET??)
>> mode of getting packets from the NIC?
>> Blacklisting pf_ring module from loading?
>>
>> Thank you
>> Marco
>>
>>
>>
>> 2018-01-17 22:16 GMT+00:00 Alfredo Cardigliano :
>>
>>> “Absolute Stats” is the total / average number of packets/bytes
>>> “Actual Stats” is the current number of packets/bytes (last second)
>>>
>>> Alfredo
>>>
>>> On 17 Jan 2018, at 21:13, Marco Teixeira  wrote:
>>>
>>> Hello list,
>>>
>>> Any PFRING wizard that can offer clues on where to start troubleshooting
>>> this variance between "Absolut Stats" vs "Actual Stats"...?
>>>
>>> 
>>> ===
>>> [marco@nprobe ~]$ sudo pfcount -i ens2f0
>>> [sudo] password for marco:
>>> Using PF_RING v.7.0.0
>>> Capturing from ens2f0 [mac: D8:D3:85:A0:12:50][if_index: 5][speed:
>>> 1Mb/s]
>>> # Device RX channels: 1
>>> # Polling threads:1
>>> Dumping statistics on /proc/net/pf_ring/stats/3096-ens2f0.3
>>> =
>>> Absolute Stats: [136'980 pkts total][0 pkts dropped][0.0% dropped]
>>> [136'980 pkts rcvd][126'559'478 bytes rcvd]
>>> =
>>>
>>> =
>>> Absolute Stats: [274'202 pkts total][0 pkts dropped][0.0% dropped]
>>> [274'202 pkts rcvd][254'708'653 bytes rcvd][274'163.89 pkt/sec][2'037.38
>>> Mbit/sec]
>>> =
>>> Actual Stats: [137'222 pkts rcvd][1'000.13 ms][137'202.92 pps][1.03 Gbps]
>>> =
>>>
>>> =
>>> Absolute Stats: [411'199 pkts total][0 pkts dropped][0.0% dropped]
>>> [411'199 pkts rcvd][382'383'683 bytes rcvd][205'575.03 pkt/sec][1'529.35
>>> Mbit/sec]
>>> =
>>> Actual Stats: [136'997 pkts rcvd][1'000.09 ms][136'983.43 pps][1.02 Gbps]
>>> =
>>> ===
>>>
>>> Thankx
>>> Marco
>>> ___
>>> Ntop-misc mailing list
>>> Ntop-misc@listgateway.unipi.it
>>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>>
>>>
>>>
>>
> ___
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
>
>
> ___
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc

Re: [Ntop-misc] nProbe performance and packet drops

2018-01-25 Thread David Notivol

Thanks Luca for your advice,

Running several nprobe instances we're able to handle all the traffic.
Just for the record, finally we got it working using zbalance with a GTP
hash and 4 application instances:

zbalance_ipc -i p2p1,p2p2 -c 1 -n 4 -m 4 -a -p

Regards,
David.


2018-01-22 22:17 GMT+01:00 Luca Deri :

> David
> sorry for the delay. What you can also do is the following
> 1. Enable RSS let’s say with two queues
> 2. start
> nprobe -i eth1@0,eth2@0 -g 1 ...
> nprobe -i eth1@1,eth2@1 -g 2 ...
>
> If this is not enough you can increase the number of RSS queues so that
> each probe has less messages to process
>
> Regards Luca
>
> On 22 Jan 2018, at 17:41, David Notivol  wrote:
>
> Hello,
>
> Sorry for replying to myself.
>
> Just adding troubleshooting information. We've tested using zbalance to
> form the virtual interface instead of our application, and we are getting
> the same results; we keep having drops.
> Thanks.
>
> Regards,
> David Notivol.
>
> 2018-01-19 16:59 GMT+01:00 David Notivol :
>
>> Hello list,
>>
>> I'm testing nProbe listening from two different 10Gb interfaces (using
>> i40e pf_ring's driver). As we need to mix up the information of these two
>> links, we use a custom application (using pf_ring sources) that creates a
>> virtual interface with traffic from the original physical ones.
>>
>> The total traffic is about 3Gbps (we expect to have more), but we are
>> seeing around 50-60% packet drops between our application and nProbe. When
>> testing with zcount/pfcount instead of nProbe, we see 0% drops.
>>
>> I've made some tuning in the nProbe parameters (hash-size, max-num-flows,
>> idle-timeout, ...), but no significant changes has been noticed.
>>
>> Drops are fewer when disabling the export to Kafka and disabling all
>> plugins (GTPv1, GTPv2 and HTTP), although we always have (around 1-2%).
>>
>> I'm pasting below my nProbe configuration, and some traffic statistics.
>>
>> Do you have any recommendation I could follow to improve this performance?
>> Thanks a lot in advance.
>>
>>
>> -- System:
>>
>> nProbe:   nprobe-8.0.171020-5797.x86_64
>> System RAM: 64GB
>> System CPU: 12 cores
>> System OS:CentOS Linux release 7.4.1708 (Core)
>> Linux Kernel:   3.10.0-693.11.6.el7.x86_64 #1 SMP Thu Jan 4 01:06:37 UTC
>> 2018 x86_64 x86_64 x86_64 GNU/Linux
>>
>> -- nProbe configuration:
>>
>> -n=none
>> -i=zc:1@0
>> -s=128
>> -t=60
>> -d=30
>> -a=0
>> -e=1
>> -B=10
>> -w=4048000
>> -M=1000
>> -z=0
>> -S=1:1
>> -E=0:0
>> -g=/var/run/nprobe-zc1-0.pid
>> --vlanid-as-iface-idx=none
>> -V=9
>> -T="%IPV4_SRC_ADDR %IPV4_DST_ADDR %IN_PKTS %IN_BYTES %OUT_PKTS %OUT_BYTES
>> %FIRST_SWITCHED %LAST_SWITCHED %L4_SRC_PORT %L4_DST_PORT %TCP_FLAGS
>> %PROTOCOL %SRC_TOS %SRC_AS %DST_AS %L7_PROTO %L7_PROTO_NAME %SRC_IP_COUNTRY
>> %SRC_IP_CITY %SRC_IP_LONG %SRC_IP_LAT %DST_IP_COUNTRY %DST_IP_CITY
>> %DST_IP_LONG %DST_IP_LAT %SRC_VLAN %DST_VLAN %DOT1Q_SRC_VLAN
>> %DOT1Q_DST_VLAN %DIRECTION %SSL_SERVER_NAME %SRC_AS_MAP %DST_AS_MAP
>> %HTTP_METHOD %HTTP_RET_CODE %HTTP_REFERER %HTTP_UA %HTTP_MIME %HTTP_HOST
>> %HTTP_SITE %UPSTREAM_TUNNEL_ID %UPSTREAM_SESSION_ID %DOWNSTREAM_TUNNEL_ID
>> %DOWNSTREAM_SESSION_ID %UNTUNNELED_PROTOCOL %UNTUNNELED_IPV4_SRC_ADDR
>> %UNTUNNELED_L4_SRC_PORT %UNTUNNELED_IPV4_DST_ADDR %UNTUNNELED_L4_DST_PORT
>> %GTPV2_REQ_MSG_TYPE %GTPV2_RSP_MSG_TYPE %GTPV2_C2S_S1U_GTPU_TEID
>> %GTPV2_C2S_S1U_GTPU_IP %GTPV2_S2C_S1U_GTPU_TEID %GTPV2_S5_S8_GTPC_TEID
>> %GTPV2_S2C_S1U_GTPU_IP %GTPV2_C2S_S5_S8_GTPU_TEID
>> %GTPV2_S2C_S5_S8_GTPU_TEID %GTPV2_C2S_S5_S8_GTPU_IP
>> %GTPV2_S2C_S5_S8_GTPU_IP %GTPV2_END_USER_IMSI %GTPV2_END_USER_MSISDN
>> %GTPV2_APN_NAME %GTPV2_ULI_MCC %GTPV2_ULI_MNC %GTPV2_ULI_CELL_TAC
>> %GTPV2_ULI_CELL_ID %GTPV2_RESPONSE_CAUSE %GTPV2_RAT_TYPE %GTPV2_PDN_IP
>> %GTPV2_END_USER_IMEI %GTPV2_C2S_S5_S8_GTPC_IP %GTPV2_S2C_S5_S8_GTPC_IP
>> %GTPV2_C2S_S5_S8_SGW_GTPU_TEID %GTPV2_S2C_S5_S8_SGW_GTPU_TEID
>> %GTPV2_C2S_S5_S8_SGW_GTPU_IP %GTPV2_S2C_S5_S8_SGW_GTPU_IP
>> %GTPV1_REQ_MSG_TYPE %GTPV1_RSP_MSG_TYPE %GTPV1_C2S_TEID_DATA
>> %GTPV1_C2S_TEID_CTRL %GTPV1_S2C_TEID_DATA %GTPV1_S2C_TEID_CTRL
>> %GTPV1_END_USER_IP %GTPV1_END_USER_IMSI %GTPV1_END_USER_MSISDN
>> %GTPV1_END_USER_IMEI %GTPV1_APN_NAME %GTPV1_RAT_TYPE %GTPV1_RAI_MCC
>> %GTPV1_RAI_MNC %GTPV1_RAI_LAC %GTPV1_RAI_RAC %GTPV1_ULI_MCC %GTPV1_ULI_MNC
>> %GTPV1_ULI_CELL_LAC %GTPV1_ULI_CELL_CI %GTPV1_ULI_SAC %GTPV1_RESPONSE_CAUSE
>> %SRC_FRAGMENTS %DST_FRAGMENTS %CLIENT_NW_LATENCY_MS %SERVER_NW_LATENCY_MS
>> %APPL_LATENCY_MS %RETRANSMITTED_IN_BYTES %RETRANSMITTED_IN_PKTS
>> %RETRANSMITTED_OUT_BYTES %RETRANSMITTED_OUT_PKTS %OOORDER_IN_PKTS
>> %OOORDER_OUT_PKTS %FLOW_ACTIVE_TIMEOUT %FLOW_INACTIVE_TIMEOUT %MIN_TTL
>> %MAX_TTL %IN_SRC_MAC %OUT_DST_MAC %PACKET_SECTION_OFFSET %FRAME_LENGTH
>> %SRC_TO_DST_MAX_THROUGHPUT %SRC_TO_DST_MIN_THROUGHPUT
>> %SRC_TO_DST_AVG_THROUGHPUT %DST_TO_SRC_MAX_THROUGHPUT
>> %DST_TO_SRC_MIN_THROUGHPUT %DST_TO_SRC_AVG_THROUGHPUT
>>

Re: [Ntop-misc] About pf_ring licences (was nProbe Pro won't do more then 1Gb/s?)

2018-01-25 Thread Luca Deri

Marco
our licenses don’t have a cap on speed, but they are per device family. So if 
these devices as 10G you need a 10G license

As you’re a university you can mail educat...@ntop.org 
 for free licenses

Regards Luca

> On 25 Jan 2018, at 12:52, Marco Teixeira  wrote:
> 
> Hello,
> 
> Regarding the output below, does one need a license to be able to run 10Gb/s 
> speeds (please mind, I'm only talking about pf_ring. nprobe is already 
> licensed with "enterprise pro")?
> 
> 
> ===
> [marco@nprobe ~]$ sudo pfcount -L -v1 | grep ens2f
> NameSystemName  Module  MAC BusID   
> NumaNodeStatus  License
> ens2f0  ens2f0  pf_ring D8:D3:85:A0:12:50   :13:00.0-1
>   Up  NotFound
> ens2f1  ens2f1  pf_ring D8:D3:85:A0:12:54   :13:00.1-1
>   DownNotFound
> [marco@nprobe ~]$ 
> [marco@nprobe ~]$ cat /proc/net/pf_ring/dev/ens2f0/info 
> Name: ens2f0
> Index:6
> Address:  D8:D3:85:A0:12:50
> Polling Mode: NAPI
> Type: Ethernet
> Family:   Standard NIC
> # Bound Sockets:  1
> TX Queues:1
> RX Queues:1
> ===
> 
> 
> Regards,
> Marco
> 
> 
> 2018-01-18 10:35 GMT+00:00 Marco Teixeira  >:
> Hi Afredo and anyone "listening",
> 
> I would like to rule out if pf_ring is the culprit here...
> What would be the correct way to have nprobe use libpcap (or AF_PACKET??) 
> mode of getting packets from the NIC?
> Blacklisting pf_ring module from loading?
> 
> Thank you
> Marco
> 
> 
> 
> 
> 2018-01-17 22:16 GMT+00:00 Alfredo Cardigliano  >:
> “Absolute Stats” is the total / average number of packets/bytes
> “Actual Stats” is the current number of packets/bytes (last second)
> 
> Alfredo
> 
>> On 17 Jan 2018, at 21:13, Marco Teixeira > > wrote:
>> 
>> Hello list,
>> 
>> Any PFRING wizard that can offer clues on where to start troubleshooting 
>> this variance between "Absolut Stats" vs "Actual Stats"...?
>> 
>> ===
>> [marco@nprobe ~]$ sudo pfcount -i ens2f0 
>> [sudo] password for marco: 
>> Using PF_RING v.7.0.0
>> Capturing from ens2f0 [mac: D8:D3:85:A0:12:50][if_index: 5][speed: 1Mb/s]
>> # Device RX channels: 1
>> # Polling threads:1
>> Dumping statistics on /proc/net/pf_ring/stats/3096-ens2f0.3
>> =
>> Absolute Stats: [136'980 pkts total][0 pkts dropped][0.0% dropped]
>> [136'980 pkts rcvd][126'559'478 bytes rcvd]
>> =
>> 
>> =
>> Absolute Stats: [274'202 pkts total][0 pkts dropped][0.0% dropped]
>> [274'202 pkts rcvd][254'708'653 bytes rcvd][274'163.89 pkt/sec][2'037.38 
>> Mbit/sec]
>> =
>> Actual Stats: [137'222 pkts rcvd][1'000.13 ms][137'202.92 pps][1.03 Gbps]
>> =
>> 
>> =
>> Absolute Stats: [411'199 pkts total][0 pkts dropped][0.0% dropped]
>> [411'199 pkts rcvd][382'383'683 bytes rcvd][205'575.03 pkt/sec][1'529.35 
>> Mbit/sec]
>> =
>> Actual Stats: [136'997 pkts rcvd][1'000.09 ms][136'983.43 pps][1.02 Gbps]
>> =
>> ===
>> 
>> Thankx
>> Marco
>> ___
>> Ntop-misc mailing list
>> Ntop-misc@listgateway.unipi.it 
>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc 
>> 
> 
> 
> ___
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc

___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc

[Ntop-misc] About pf_ring licences (was nProbe Pro won't do more then 1Gb/s?)

2018-01-25 Thread Marco Teixeira

Hello,

Regarding the output below, does one need a license to be able to run
10Gb/s speeds (please mind, I'm only talking about pf_ring. nprobe is
already licensed with "enterprise pro")?


===
[marco@nprobe ~]$ sudo pfcount -L -v1 | grep ens2f
NameSystemName  Module  MAC BusID
 NumaNodeStatus  License
ens2f0  ens2f0  pf_ring D8:D3:85:A0:12:50   :13:00.0-1
Up  NotFound
ens2f1  ens2f1  pf_ring D8:D3:85:A0:12:54   :13:00.1-1
DownNotFound
[marco@nprobe ~]$
[marco@nprobe ~]$ cat /proc/net/pf_ring/dev/ens2f0/info
Name: ens2f0
Index:6
Address:  D8:D3:85:A0:12:50
Polling Mode: NAPI
Type: Ethernet
Family:   Standard NIC
# Bound Sockets:  1
TX Queues:1
RX Queues:1
===



Regards,
Marco



2018-01-18 10:35 GMT+00:00 Marco Teixeira :

> Hi Afredo and anyone "listening",
>
> I would like to rule out if pf_ring is the culprit here...
> What would be the correct way to have nprobe use libpcap (or AF_PACKET??)
> mode of getting packets from the NIC?
> Blacklisting pf_ring module from loading?
>
> Thank you
> Marco
>
>
>
> 2018-01-17 22:16 GMT+00:00 Alfredo Cardigliano :
>
>> “Absolute Stats” is the total / average number of packets/bytes
>> “Actual Stats” is the current number of packets/bytes (last second)
>>
>> Alfredo
>>
>> On 17 Jan 2018, at 21:13, Marco Teixeira  wrote:
>>
>> Hello list,
>>
>> Any PFRING wizard that can offer clues on where to start troubleshooting
>> this variance between "Absolut Stats" vs "Actual Stats"...?
>>
>> 
>> ===
>> [marco@nprobe ~]$ sudo pfcount -i ens2f0
>> [sudo] password for marco:
>> Using PF_RING v.7.0.0
>> Capturing from ens2f0 [mac: D8:D3:85:A0:12:50][if_index: 5][speed:
>> 1Mb/s]
>> # Device RX channels: 1
>> # Polling threads:1
>> Dumping statistics on /proc/net/pf_ring/stats/3096-ens2f0.3
>> =
>> Absolute Stats: [136'980 pkts total][0 pkts dropped][0.0% dropped]
>> [136'980 pkts rcvd][126'559'478 bytes rcvd]
>> =
>>
>> =
>> Absolute Stats: [274'202 pkts total][0 pkts dropped][0.0% dropped]
>> [274'202 pkts rcvd][254'708'653 bytes rcvd][274'163.89 pkt/sec][2'037.38
>> Mbit/sec]
>> =
>> Actual Stats: [137'222 pkts rcvd][1'000.13 ms][137'202.92 pps][1.03 Gbps]
>> =
>>
>> =
>> Absolute Stats: [411'199 pkts total][0 pkts dropped][0.0% dropped]
>> [411'199 pkts rcvd][382'383'683 bytes rcvd][205'575.03 pkt/sec][1'529.35
>> Mbit/sec]
>> =
>> Actual Stats: [136'997 pkts rcvd][1'000.09 ms][136'983.43 pps][1.02 Gbps]
>> =
>> ===
>>
>> Thankx
>> Marco
>> ___
>> Ntop-misc mailing list
>> Ntop-misc@listgateway.unipi.it
>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>
>>
>>
>
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc

Re: [Ntop-misc] About pf_ring licences (was nProbe Pro won't do more then 1Gb/s?)

Re: [Ntop-misc] About pf_ring licences (was nProbe Pro won't do more then 1Gb/s?)

Re: [Ntop-misc] About pf_ring licences (was nProbe Pro won't do more then 1Gb/s?)

Re: [Ntop-misc] About pf_ring licences (was nProbe Pro won't do more then 1Gb/s?)

Re: [Ntop-misc] nProbe performance and packet drops

Re: [Ntop-misc] About pf_ring licences (was nProbe Pro won't do more then 1Gb/s?)

[Ntop-misc] About pf_ring licences (was nProbe Pro won't do more then 1Gb/s?)

7 matches

Site Navigation

Mail list logo

Footer information