Re: [Ntop-misc] [Ntop] PFring 7.5.0 ZC unable to read packet when bpf filter is enabled

Hi Jatin I replied on github, please keep using it for issues (and please do not send the same request to multiple channels..) Thank you Alfredo > On 25 Nov 2020, at 12:53, Jatin Sahu wrote: > > Hi, > > I am using PFRing ZC libraries to read VLAN tagged GTP traffic from intel > card. > But wh

Re: [Ntop-misc] enable RSS cause kernel crashed

Hi Wang did you update from a previous pf_ring version that was working with no crashes? Can I see the zcount command line which is causing this? Weird this is happening with X520 and not happening with 82599 as they should behave the same, need to investigate. What 7.6 version are you running exac

Re: [Ntop-misc] PF_RING 7.5.0 on Ubuntu 18.04

Hi Hovsep please provide the zbalance_ipc and pfcount command lines and output (please do not run any other application in this test) Regards Alfredo > On 13 Mar 2020, at 15:15, Hovsep Levi wrote: > > Here's what I've tried. > > The interface driver looks ok, ixgbe cpu_affinity values use a Co

Re: [Ntop-misc] PF_RING 7.5.0 on Ubuntu 18.04

Hi Hovsep are you able to capture from queues > 0 with pfcount? Regards Alfredo > On 31 Jan 2020, at 17:52, Hovsep Levi wrote: > > Hello ! > > > I have a problem to make PF_RING work on Ubuntu 18.04. > > zbalance_ipc will start OK with multiple consumer queues. Tcpdump cannot > read packet

Re: [Ntop-misc] zc with RSS kill the management interface of my host

collisions 0 > device memory 0xddbc-ddbd > > p2p4: flags=4099 mtu 1500 > ether 00:1b:21:b0:5c:ad txqueuelen 1000 (Ethernet) > RX packets 0 bytes 0 (0.0 B) > RX errors 0 dropped 0 overruns 0 frame 0 > TX packets 0 bytes 0 (0

Re: [Ntop-misc] zc with RSS kill the management interface of my host

Hi Wang please provide: 1. lspci | grep Eth 2. ifconfig 3. ethtool -i {p1p1,p1p2,} Thank you Alfredo > On 21 Jan 2020, at 08:44, Wang wrote: > > hi, > I have 2 capture interfaces(p1p1 and p1p2, 10Gb) and 1 management interface > in my server. After I have setup the number of rss queue of p1p

Re: [Ntop-misc] confused abount ZC Load-Balancing

> > Sent from my iPhone > >> On Jan 21, 2020, at 12:24 AM, Alfredo Cardigliano >> wrote: >> >> Correct. A zbalance_ipc queue is a software queue belonging to the >> cluster created by zbalance_ipc. You can use zcount to open a RSS queue. >>

Re: [Ntop-misc] confused abount ZC Load-Balancing

I use rss to do the load balance, will zcount work? > > Sent from my iPhone > >> On Jan 21, 2020, at 12:07 AM, Alfredo Cardigliano >> wrote: >> >> Hi >> please use zcount_ipc to attack to a ZC queue created by zbalance_ipc, >> the zcount exampl

Re: [Ntop-misc] confused abount ZC Load-Balancing

Hi please use zcount_ipc to attack to a ZC queue created by zbalance_ipc, the zcount example you are using is meant to be used to capture from an interface (it creates a cluster). Alfredo > On 20 Jan 2020, at 17:04, Wang wrote: > > Hi there, > > I am using zbalance_ipc to spread packets to mul

Re: [Ntop-misc] Query related to disk2n + ZC license

to latest version? But > that will require renewal of disk2n license also right ? > Cant we generate license for old version of pf_ring zc so that we can use the > existing disk2n application? > > Regards. > Chandrika > > On Thu, Jan 9, 2020 at 4:24 PM Alfredo Cardigl

Re: [Ntop-misc] Query related to disk2n + ZC license

Hi Chandrika your application is too old to support latest licenses, a software update is required.. Regards Alfredo > On 9 Jan 2020, at 11:44, Chandrika Gautam > wrote: > > Hi Alfredo &Team, > We have disk2n (v.2.7.160920) license and Pfring_ZC license installed on same > server. We have i

Re: [Ntop-misc] how to get the timestamp of packets recv by pfring zc driver

Hi Wang the ZC library does not compute the timestamp by default for max performance, please add the PF_RING_ZC_DEVICE_SW_TIMESTAMP flag to pfring_zc_open_device() Regards Alfredo > On 8 Jan 2020, at 11:04, Wang wrote: > > Hi, there, > > I found that the ts is always set to 0 if the packet re

Re: [Ntop-misc] any drop statistics for pfring zc driver

Hi Wang please note ZC is a kernel-bypass technology, the kernel module does not have visibility of drop counters on the interface, you should look at application stats (as the application can read drop counters from the ZC interface). This said, our applications export stats to /proc/net/pf_ring/

Re: [Ntop-misc] help with packet dropping when bursting traffic

iver and my app to. > > Many thanks, > Wang > > Sent from my iPhone > >> On Dec 27, 2019, at 5:29 PM, Alfredo Cardigliano > <mailto:cardigli...@ntop.org>> wrote: >> >> Hi >> it seems you are not actually enabling ZC capture, please add the

Re: [Ntop-misc] help with packet dropping when bursting traffic

(MemoryModule) > HostBridge L#0 > PCIBridge > PCI 14e4:163b > Net L#0 "em1" > PCI 14e4:163b > Net L#1 "em2" > PCIBridge > PCI 1000:0079 > Block(Disk) L#2 "sda" > PCIBridge >

Re: [Ntop-misc] n2disk: 100Gbps?

gt; > Hi Alfredo > > That sounds a little bit like a challenge. > There is no "nBox Recorder" for 100Gbps? > > Regards, > Marcel > > > > -Ursprüngliche Nachricht- > Von: ntop-misc-boun...@listgateway.unipi.it > Im Auftrag von Alfredo Car

Re: [Ntop-misc] n2disk: 100Gbps?

> > -Ursprüngliche Nachricht- > Von: ntop-misc-boun...@listgateway.unipi.it > Im Auftrag von Alfredo Cardigliano > Gesendet: Freitag, 13. Dezember 2019 14:40 > An: ntop-misc@listgateway.unipi.it > Betreff: Re: [Ntop-misc] n2disk: 100Gbps? > > Hi Marcel > fm10k

Re: [Ntop-misc] n2disk: 100Gbps?

Hi Marcel fm10k-based adapters support 100G connectivity, however they are not optimized to handle full 100Gbps. Please consider using FPGA adapters if you want to record 100Gbps to disk (and a good NVMe disks array). Regards Alfredo > On 13 Dec 2019, at 14:22, Lüthi Marcel FUB wrote: > > Hi.

Re: [Ntop-misc] Problem using systemctl cluster@

Hi Mike I updated the doc. Thank you Alfredo > On 10 Dec 2019, at 16:49, Mike Iglesias wrote: > > On 12/10/19 7:38 AM, Alfredo Cardigliano wrote: >> Hi Mike >> please use one option per line, as in the example below: >> >> -c=99 >> -i=p1p1 >> -n=2

Re: [Ntop-misc] Problem using systemctl cluster@

Hi Mike please use one option per line, as in the example below: -c=99 -i=p1p1 -n=2 -m=2 -g=2 Alfredo > On 10 Dec 2019, at 00:45, Mike Iglesias wrote: > > I'm trying to set up the systemctl cluster@ files to use zbalance_ipc to > balance a stream. In /etc/cluster/cluster-99.conf I have this:

Re: [Ntop-misc] help with packet dropping when bursting traffic

Hi please provide: - the pfcount command you are using - cat /proc/net/pf_ring/dev//info - cat /proc/cpuinfo - lstopo Thank you Alfredo > On 24 Nov 2019, at 07:38, Yong Wang wrote: > > > Hi there, I am struggling with a weird packet dropping. My environment is > pfring zc with intel x520 ni

Re: [Ntop-misc] Query regarding zc driver & license

Hi Chandrika you do not need a licenze to use the adapter in standard mode, even if you are loading a ZC driver. Please note that ZC drivers are patched Intel drivers, which are slightly different from vanilla linux driver: I would not expect huge performance differences, however there could be

Re: [Ntop-misc] Query on software using Pfring 7.5 and i40e driver

using Pfring 7.5 and i40e driver >>> >>> Hi Alfredo, >>> >>> Have you been able to look at this further ??? >>> >>> Any feedback on ksoftirq reaching 100% continuously. >>> >>> Regards, >>> Chandrika >>> &g

Re: [Ntop-misc] Query on software using Pfring 7.5 and i40e driver

iPhone > > On Sep 4, 2019, at 8:11 PM, Alfredo Cardigliano <mailto:cardigli...@ntop.org>> wrote: > >> Hi Chandrika >> this is definitely strange: please note that with standard drivers >> interrupts >> are not controlled by PF_RING as they a

Re: [Ntop-misc] 10/40Gb simple Tap

Thanks, > Oren > > From: ntop-misc-boun...@listgateway.unipi.it > on behalf of Alfredo Cardigliano > > Sent: Thursday, September 5, 2019 4:29 PM > To: ntop-misc@listgateway.unipi.it > Subject: Re: [Ntop-misc] 10/40Gb simple Tap > > Hi Oren > as of the

Re: [Ntop-misc] 10/40Gb simple Tap

> <5Gbps > The 1Gb filter is set by selecting 802.1q VLANs (alternatively, may be > replaced by Segment/IP range filter); 10Gb are unfiltered - namely copy > everything > Thanks, > Oren > > From: ntop-misc-boun...@listgateway.unipi.it > on behalf of Alfredo Cardigli

Re: [Ntop-misc] Query on software using Pfring 7.5 and i40e driver

be no interrupts with i40e driver when used with pf_ring ?? > > Regards, > Chandrika > Sent from my iPhone > > On Sep 4, 2019, at 1:04 PM, Alfredo Cardigliano <mailto:cardigli...@ntop.org>> wrote: > >> Hi Chandrika >> are you observing better performance w

Re: [Ntop-misc] Query on software using Pfring 7.5 and i40e driver

zc: prefix. > Using this we have observed better performAnce in our application when used > with ixgbe driver. > > Regards, > Chandrika > > Sent from my iPhone > > On Aug 28, 2019, at 12:58 PM, Alfredo Cardigliano <mailto:cardigli...@ntop.org>> wrote: > &g

Re: [Ntop-misc] 10/40Gb simple Tap

Hi Oren traffic aggregation from multiple ingress ports and duplication/distribution to multiple egress interfaces is available with PF_RING ZC, we have a tool (zbalance_ipc) which is based on the ZC API and able to do that A small subset of the functionalities provided by this tool are described a

Re: [Ntop-misc] Query on software using Pfring 7.5 and i40e driver

Hi Chandrika are you using the i40e-zc driver or the standard driver? Please note that ZC enables interrupts only when required for performance reason, for example some libpcap-based applications require interrupts as they use poll/select, instead many pf_ring-based application do not use interru

Re: [Ntop-misc] Not able to achieve consistent 10Gbps on Napatech 2x40G card for more than 10 seconds

how can that be slow !! > Please help to validate it! > > Sent from my iPhone > > On Aug 23, 2019, at 1:49 PM, Alfredo Cardigliano <mailto:cardigli...@ntop.org>> wrote: > >> Hi >> please note the "WARNING: [sender] waiting.. (buffer empty)” message

Re: [Ntop-misc] Not able to achieve consistent 10Gbps on Napatech 2x40G card for more than 10 seconds

Hi please note the "WARNING: [sender] waiting.. (buffer empty)” messages in your output, this means that the IO is not fast enough reading data from disk and providing it to disk2n, what kind of storage are you using? Alfredo > On 23 Aug 2019, at 10:05, Chandrika Gautam > wrote: > > > > Se

Re: [Ntop-misc] sar output/zbalance_ipc

root 7554 99 06:27 ? 12:12:02 /usr/local/pf/sbin/zbalance_ipc -i ens5f0 -m >> 4 -n 48 -c 99 -g 70 -S 71 -p >> >> Output at start: >> >> 20/Jun/2019 06:27:29 [zbalance_ipc.c:1116] Starting balancer with 48 >> consumer queues.. >> 20/Jun/2019

Re: [Ntop-misc] sar output/zbalance_ipc

Hi Jim please note that you are not using ZC, your adapter is supported by the ixgbe-zc driver, for best performance please configure it following this guide: http://www.ntop.org/guides/pf_ring/get_started/packages_installation.html

Re: [Ntop-misc] Problem with bro/zeek and pf_ring/ZC

Hi Jim it seems that Zeek has not been linked against the pf_ring aware libpcap: Could you double check with: ldd /usr/local/bro/bin/bro | grep pcap libpcap.so.1 => /usr/local/lib/libpcap.so.1 (0x7fa371e33000) As explained in this guide? http://www.ntop.org/guides/pf_ring/thirdparty/

Re: [Ntop-misc] PF_RING 7.x, ZeroCopy and ksoftirqd

Hi Hovsep please provide /proc/net/pf_ring/dev/eth4/info Alfredo > On 3 Oct 2018, at 17:21, Hovsep Levi wrote: > > I forgot about my testing using CPU 17 with previous post. > > This is a test using CPU 16 which is the first CPU on the local NUMA node > where the NIC is attached. > > /opt/p

Re: [Ntop-misc] nprobe dying with Accolade

Hi David I will send you instructions for generating a core dump in order to debug this issue, btw please use https://github.com/ntop/nProbe/issues for support requests/tickets. Thank you Alfredo > On 13 Sep 2018, at 09:26, David Notivol wrote: > > Hell

Re: [Ntop-misc] distributed nprobe

Hi Felix you can use the standard pf_ring kernel clustering in nProbe adding the --cluster-id option (you need to specify the same id for all nProbe instances in the group in order to distribute the traffic). You can use a bpf filter (--bpf-filter|-f ) to filter traffic. Regards Alfredo > On 7 S

Re: [Ntop-misc] PF_RING Intel 82599ES hardware filters

com/content/dam/www/public/us/en/documents/datasheets/82599-10-gbe-controller-datasheet.pdf>, > page 292). > > So, I'm wondering which code to use to be able to insert the 32K filters you > mention in the FAQ? > > Best Regards, > Raphael > > > > On Thu, A

Re: [Ntop-misc] PF_RING Intel 82599ES hardware filters

Hi Raphael please note that it is possible to use both filters types using the pfring_add_hw_rule() API, just set hw_filtering_rule.rule_family_type to intel_82599_five_tuple_rule or intel_82599_perfect_filter_rule and set the corresponding struct (intel_82599_five_tuple_filter_hw_rule / struct i

Re: [Ntop-misc] Determining rx queues of an interface

Hi Amir the number of rx queues is determined loading the driver or at runtime with ethtool ‘combined’ as you can see at: https://github.com/ntop/PF_RING/blob/dev/drivers/intel/i40e/i40e-2.4.6-zc/src/load_driver.sh#L39

Re: [Ntop-misc] problem starting PF_RING ZC with multiple receive threads

Hi Robert please note that ZC is not compatible with kernel clustering, this means that: 1. you should not set --pfring-cluster-id=99 --pfring-cluster-type=cluster_flow 2. if you want multiple capture threads, you should use RSS and capture from each RSS interface/queue (e.g. zc:p1p1@0 and zc:p1p1@

Re: [Ntop-misc] nbpf questions

What is the main influential factor about the maximum num of host which > could be supported by nbpf in bpf string? > > Alfredo Cardigliano mailto:cardigli...@ntop.org>> > 于2018年6月28日周四 下午3:34写道： > Hi Bowen > said that I am still missing something in your implementation

Re: [Ntop-misc] nbpf questions

imum num of host > is 466 and it seems that the number of host item has no effect on the > processing speed of PF_RING. Are my test result reliable? > > Alfredo Cardigliano mailto:cardigli...@ntop.org>> > 于2018年6月27日周三 下午4:05写道： > Hi Bowen > the nbpf syntax actually

Re: [Ntop-misc] nProbe performance, zbalance packet drops

in my previous email. > - 1.log = scenario in your point 1, including top, zbalance output, and > nprobe stats. I do not see the attachments, did you forget to enclose them? Alfredo > > El mié., 27 jun. 2018 a las 12:13, Alfredo Cardigliano ( <mailto:cardigli...@ntop.org>>) escrib

Re: [Ntop-misc] nProbe performance, zbalance packet drops

629 > Bytes:43064091353 > Packets: 70834104 > Dropped: 712427 > > Duration: 0:00:41:14:551 > Bytes:42072869897 > Packets: 67360770 > Dropped: 696460 > > Duration: 0:00:41:14:625 > Bytes:44323715294 > Packets: 73420290 > Dropped: 851818 > >

Re: [Ntop-misc] nbpf questions

Hi Bowen the nbpf syntax actually supports the not operator, however it depends on the actual backend (we probably need to extend the guide commenting more about this). For instance translating the filter into hw rules for offloading it to the adapter, in most cases it is not possible to use the n

Re: [Ntop-misc] nProbe performance, zbalance packet drops

Hi David please also provide statistics from zbalance_ipc (output or log file) and nprobe (you can get live stats from /proc/net/pf_ring/stats/) Thank you Alfredo > On 26 Jun 2018, at 15:32, David Notivol wrote: > > Hello list, > > We're using nProbe to export flows information to kafka. We're

Re: [Ntop-misc] pfring devel rpm package

Hi what is the issue you are experiencing installing the standard package? It should work according to the guide at http://www.ntop.org/guides/pf_ring/thirdparty/bro.html please let us know if something is broken.. Alfredo > On 19 Jun 201

Re: [Ntop-misc] cento crash - corrupted double-linked list

Hi Mike I will contact you directly for debugging this issue. Regards Alfredo > On 23 May 2018, at 20:04, Lang, Michael wrote: > > Hello, > > I’m having an issue where cento crashes around 10-14 days after launch. I’m > currently running: > > [root@madmax ~]# cento --version > v.1.4.180420

Re: [Ntop-misc] Debian Jessie (3.16.0-6-amd64) and PFRING 7.0.0

Hi Rich latest Debian 8 3.16.0-6 kernel is now supported, I pushed a patch on github and building new packages right now. Best Regards Alfredo > On 8 May 2018, at 22:19, Richard Angeletti wrote: > > Hello, > > I'm having issues getting the stable packages for Debian Jessie to startup on > ke

Re: [Ntop-misc] More questions

> On 8 May 2018, at 18:13, Carl Rotenan wrote: > > First off, Alfredo thanks for answering all my questions as I get up to speed > on PF_RING. > > I have a few other questions based off of some /proc/net/pf_ring/ output. > > 1. In the first cat I have 0 free slots and the second 13k, am I dr

Re: [Ntop-misc] /proc/net/pf_ring

Hi Carl that number is the ring ID. Alfredo > On 8 May 2018, at 05:18, Carl Rotenan wrote: > > Hi, > > Sorry in advance if this is a dumb question, but what does the last number > after the . signify? > > -. > > Since this listing starts at 19 and I'm running with 18 cores, and I stopped >

Re: [Ntop-misc] Module option question

Hi Carl > On 7 May 2018, at 19:20, Carl Rotenan wrote: > > Could someone please explain the modules options in a little bit more detail? > > enable_ip_defrag > Set to 1 to enable IP defragmentation, only rx traffic is defragmented. This option should be set to enable fragments reconstruction,

Re: [Ntop-misc] Ring slots

Hi Carl increasing the buffering power increases the ability to handle spikes without loosing packets in case of applications doing heavy processing. In general it is recommended to use the max number of slots supported by the adapter in case of ZC (default if you use our script), and a reasonab

Re: [Ntop-misc] Question regarding implementation of API function pfring_get_ring_id()

you can > consider adopting it. > > Amir > > On Thu, May 3, 2018 at 4:11 PM, Alfredo Cardigliano <mailto:cardigli...@ntop.org>> wrote: > Hi Amir > ring_id should not change, thus it can be cached in userspace, > any reason you cannot cache it inside the applica

Re: [Ntop-misc] Question regarding implementation of API function pfring_get_ring_id()

Hi Amir ring_id should not change, thus it can be cached in userspace, any reason you cannot cache it inside the application? Alfredo > On 3 May 2018, at 15:09, Amir Kaduri wrote: > > User-space API function pfring_get_ring_id() always bring the ring id from > the kernel. In some applications,

Re: [Ntop-misc] pf_ring: Clarification regarding the relation between poll-watermark and poll-duration

atermark in combination with a timeout is a good idea. Alfredo > Amir > > > On Thu, Apr 26, 2018 at 6:00 PM, Alfredo Cardigliano <mailto:cardigli...@ntop.org>> wrote: > > >> On 26 Apr 2018, at 15:34, Amir Kaduri > <mailto:akadur...@gmail.com>> wrote:

Re: [Ntop-misc] pf_ring: Clarification regarding the relation between poll-watermark and poll-duration

= 0. > Correct? Correct Alfredo > > Thanks, > Amir > > On Mon, Apr 9, 2018 at 10:51 AM, Alfredo Cardigliano <mailto:cardigli...@ntop.org>> wrote: > Hi Amir > if I understand correctly, pfcount_multichannel is working, while in your > application >

Re: [Ntop-misc] pf_ring: Clarification regarding the relation between poll-watermark and poll-duration

g during initialization? > (for simplicity I'm not using rehash, and not using any filters). > > Thanks > > On Tue, Oct 31, 2017 at 6:32 PM, Alfredo Cardigliano <mailto:cardigli...@ntop.org>> wrote: > Hi Amir > that's correct, however for some reason

Re: [Ntop-misc] packet drops are observed in pf_ring statistics

ntation logic is enabled in application > but we do not see any drops in pf_ring statistics also. > > Will output of /proc/net/pf_ring/ be enough ? Are you looking for some > other statistics? > > Regards, > Chandrika > > On Tue, Mar 20, 2018 at 2:23 PM, Alfredo Card

Re: [Ntop-misc] numa_cpu_affinity/binding cores for snort

Hi Jim everything looks good, just one change to the driver parameters, this is enough: RSS=1,1 numa_cpu_affinity=18,18 Regards Alfredo > On 21 Mar 2018, at 22:41, Jim Hranicky wrote: > > If 'hwloc-ls' tells me my ixgbe device is on node 1: > > NUMANode L#0 (P#0 62GB) > [...] > PCIBrid

Re: [Ntop-misc] packet drops are observed in pf_ring statistics

g this? > Or can we tune ipfrag related parameters to support more number of fragmented > packets. > > > On Mon, Mar 19, 2018 at 1:51 PM, Alfredo Cardigliano <mailto:cardigli...@ntop.org>> wrote: > Hi Gautam > I guess you are using standard drivers, with defragmen

Re: [Ntop-misc] packet drops are observed in pf_ring statistics

Hi Gautam I guess you are using standard drivers, with defragmentation enabled in the pf_ring kernel module, in that case if you have many fragments, at that rate, that could slow down the processing. Did you try disabling defragmentation to figure out if the bottleneck is there? Regards Alfredo

Re: [Ntop-misc] nProbe Pro won't do more then 1Gb/s?

“Absolute Stats” is the total / average number of packets/bytes “Actual Stats” is the current number of packets/bytes (last second) Alfredo > On 17 Jan 2018, at 21:13, Marco Teixeira wrote: > > Hello list, > > Any PFRING wizard that can offer clues on where to start troubleshooting this > var

Re: [Ntop-misc] nProbe Pro won't do more then 1Gb/s?

Hi Marco it seems there is no packet loss, did you check the interface stats with ethtool -S to check if pats are getting lost at interface level? Best Regards Alfredo > On 16 Jan 2018, at 17:17, Marco Teixeira wrote: > > Hello, > > Is PF_RING the culprit here ?? How to tweak this? > Absolute

Re: [Ntop-misc] PF_RING Error : causes memory size to wrap, unable to allocate memory

uses memory size > to wrap > > Regards, > Gautam > > On Tue, Jan 9, 2018 at 2:32 PM, Chandrika Gautam > mailto:chandrika.iitd.r...@gmail.com>> wrote: > Thanks Alfredo! > > Regards, > Chandrika > > On Tue, Jan 9, 2018 at 2:13 PM, Alfredo Cardigliano

Re: [Ntop-misc] PF_RING Error : causes memory size to wrap, unable to allocate memory

.com>> wrote: > Hi Alfredo, > > Does this error mean that packets are getting lost ? Problem is that I have > not faced this issue in our lab. Its hit in one of the production server. > Can you also explain what have you fixed to resolve this? > > Regards, > Gau

Re: [Ntop-misc] PF_RING Error : causes memory size to wrap, unable to allocate memory

s, > Gautam > > On Sun, Jan 7, 2018 at 5:10 PM, Alfredo Cardigliano <mailto:cardigli...@ntop.org>> wrote: > Hi Gautam > this is not related to hugepages (actually hugepages reserve physical memory, > thus > they can affect allocation, however in this specifi

Re: [Ntop-misc] PF_RING Error : causes memory size to wrap, unable to allocate memory

reating the hugepages. > > Regards, > Gautam > > On Fri, Jan 5, 2018 at 10:52 AM, Chandrika Gautam > mailto:chandrika.iitd.r...@gmail.com>> wrote: > Hi Alfredo, > > MTU is 1518 for all 6 interfaces except for lo (loopback) interface(65535). > > Regards, > Gau

Re: [Ntop-misc] PF_RING Error : causes memory size to wrap, unable to allocate memory

_RING] ERROR: min_num_slots (409600, slot len = 65576) causes memory size > to wrap > > [PF_RING] ring_mmap(): unable to allocate memory > > Regards, > Gautam > > On Tue, Jan 2, 2018 at 2:46 PM, Alfredo Cardigliano <mailto:cardigli...@ntop.org>> wrote: > Hi Gautam &

Re: [Ntop-misc] PF_RING Error : causes memory size to wrap, unable to allocate memory

Hi Gautam please provide the error, I see just the insmod command.. Regards Alfredo > On 27 Dec 2017, at 06:26, Chandrika Gautam > wrote: > > Hi, > > We are receiving below error while loading the pf_ring using below command > even though there is free memory available on server. Please let

Re: [Ntop-misc] nProbe Cento Performance Tuning

Hi Mike it seems that running in passive wait is causing some loss, this is due to the poor buffering power in i40e cards: when there is no packets, the application calls poll() to wait for new packets until an interrupt is raised, then it wakes up and continue processing traffic. What happens is

Re: [Ntop-misc] nProbe Cento Performance Tuning

What happens if you add -a to pfcount? Alfredo > On 15 Dec 2017, at 20:25, Lang, Michael wrote: > > Hi Alfredo, > > Thank you for the response. Here is the output you requested: > > [root@madmax ~]# pfcount -i zc:enp1s0 > Using PF_RING v.7.0.0 > Capturing from zc:enp1s0 [mac: 3C:FD:FE:A2:B9:

Re: [Ntop-misc] nProbe Cento Performance Tuning

Hi Mike could you try running pfcount -i zc:enp1s0 (configuring the interface with a single RSS queue)? Thank you Alfredo > On 15 Dec 2017, at 16:29, Lang, Michael wrote: > > Hello, > > I’m in the process of configuring new 40G hardware with nProbe Cento to > replace older hardware with 2 x

Re: [Ntop-misc] nscrub problems

Hi Spiros please read my answers below. > On 3 Dec 2017, at 08:15, Spiros Papageorgiou wrote: > > HI all, > > I have an nscrub setup on an LTS16. The config is routing/assymetric mode. I > have a few problems and questions: > - When I stop nscrub the nscrub-VM is left at a cripppled state wher

Re: [Ntop-misc] Compilation of ixgbe-zc- module on RHEL 6.7 with kernel version-2.6.32-696.16.1.el6.x86_64

soon. > Meanwhile we can safely use the ixgbe driver code from 7.0 with PF_RING 6.2.0 > right ? > > > Regards, > Gautam > > On Thu, Nov 30, 2017 at 2:09 PM, Alfredo Cardigliano <mailto:cardigli...@ntop.org>> wrote: > Hi Gautam > please move to latest stabl

Re: [Ntop-misc] Compilation of ixgbe-zc- module on RHEL 6.7 with kernel version-2.6.32-696.16.1.el6.x86_64

Hi Gautam please move to latest stable (7.0) or use the drivers included in that version, we no longer support 6.2.. Alfredo > On 30 Nov 2017, at 05:50, Chandrika Gautam > wrote: > > Hi all, > > We are using PF_RING-6.2.0 and IXGBE-ZC compilation failing on the RHEL 6.7 > with kernel version

Re: [Ntop-misc] nscrub config

Hi Spiros please read below > On 27 Nov 2017, at 12:44, Spiros Papageorgiou wrote: > > Hi all, > > I'm need some help configuring nscrub. My setup is routed/symmetric for now: > Internet <---> ens160 (native vlan) <> ens160.838 (servers) > > with just one phy interface (--wan-interface=zc:

Re: [Ntop-misc] nscrub installation

Hi Spiros did you configure the i40e zc driver according to https://github.com/ntop/PF_RING/blob/dev/doc/README.apt_rpm_packages.md ? Please provide cat /proc/net/pf_ring/dev/ens160/info Best Regards Alfredo > On 25 Nov 2

Re: [Ntop-misc] pfring version issues

Hi Felix please make sure your application is not linking the wrong pfring library (not sure if you are using static or dynamic linking), I do not see any other possible reason. Best Regards Alfredo > On 16 Nov 2017, at 11:25, Felix Erlacher wrote: > > Dear All, > > I am trying to use the pfri

Re: [Ntop-misc] Fw: PFRING 7.0 ZC ixgbe (data all zeros) non-ZC (correct)

Hi please provide: 1. card model 2. latest pf_ring version that was working, and the version you are using now 3. do you see the same when using pfcount -i zc:enp10s0f0 -v 2? Thank you Alfredo > On 10 Nov 2017, at 23:50, buck kavin wrote: > > Trying a new list. Still having issues here. Possibl

Re: [Ntop-misc] nscrub routing mode setup problems

Hi Spiros yes you need to create vlan interfaces and assign IPs in linux, when you start nscrub it will detect them. Alfredo > On 6 Nov 2017, at 15:29, Spiros Papageorgiou wrote: > > Hi all, > > It is not clear to me how to configure nscrub when I use routing mode. I am > using one phy inter

Re: [Ntop-misc] Using upgraded i40e from pf_ring 7.0 (2.2.4), on pf_ring 6.6.0

Hi Amir the driver API is the same, thus you can do that, however I do not recommend you upgrading to 2.2.4 as this version seems to be not really stable yet, we are working on this. Alfredo > On 2 Nov 2017, at 10:31, Amir Kaduri wrote: > > Hi, > > I'm using pf_ring 6.6.0 (not using ZC) on C

Re: [Ntop-misc] pf_ring: Clarification regarding the relation between poll-watermark and poll-duration

ration is set to 1 (1 millisecond I assume), I expect the > condition to check this also (meaning, there are packets in queue but 1 > millisecond passed and they weren't read), > the wake_up_interruptible should also be called. No? > > Thanks, > Amir > > >> On T

Re: [Ntop-misc] pf_ring: Clarification regarding the relation between poll-watermark and poll-duration

ackets to the ring (thus not updating tot_insert). Alfredo > I remind that I set the watermark to be high, in order to see the > poll_duration takes effect. > > Could you please approve that you don't see any problem in the code? > > Thanks, > Amir > > > On Thu, Oct 26, 2

Re: [Ntop-misc] i40e 2.2.4 pfring 7.0.0

y test). Please provide the full dmesg output after a crash. Thank you Alfredo > On 30 Oct 2017, at 17:00, Alfredo Cardigliano wrote: > > Hi Jeremy > please open an issue on https://github.com/ntop/PF_RING/issues > <https://github.com/ntop/PF_RING/issues> to keep track on this

Re: [Ntop-misc] PF_RING kernel module soft lockup with bro ids

module of PF_RING or there is something wrong with my application calling > PF_RING’s kernel module. If there is something wrong with my application > method, I need to check my logic of application program. Now I am very > confused about this problem. > Looking forward to your

Re: [Ntop-misc] i40e 2.2.4 pfring 7.0.0

Hi Jeremy please open an issue on https://github.com/ntop/PF_RING/issues to keep track on this, please also post a full dmesg output if possible. Thank you Alfredo > On 30 Oct 2017, at 16:55, Jeremy Erb wrote: > > Upgrading to PF_RING 7.0.0 with the new

Re: [Ntop-misc] PF_RING kernel module soft lockup with bro ids

Hi Bowen Li any chance you can move to latest stable and check if you are still able to reproduce it? Thank you Alfredo > On 30 Oct 2017, at 08:15, Bowen Li wrote: > > Hi all, > Recently，I run bro cluster with PF_RING 6.4.1 as the package capturing > framework. However, I found a strange

Re: [Ntop-misc] Multiple ZC Captures

zed during peak hours. > > When Tcpdump is run, it's not matching all traffic on a port. Captures are > run for specific things based on what a user is troubleshooting; e.g., > traffic between a specific source/destination IP address. > > -Terry > > > On

Re: [Ntop-misc] Multiple ZC Captures

ally, as it would seem that users would have to try multiple > queues each time until they find one that is free. > > Thanks as always. > > -Terry > > > On Tuesday, October 3, 2017, 6:30:17 AM EDT, Alfredo Cardigliano > wrote: > > > Hi Terry > please

Re: [Ntop-misc] pf_ring: Clarification regarding the relation between poll-watermark and poll-duration

Hi Amir yes, that’s the way it should work, if this is not the case, some debugging is needed to identify the problem Alfredo > On 26 Oct 2017, at 10:14, Amir Kaduri wrote: > > Basically, the functionality that I would like to have is even if less than > poll-watermark-threshold (default: 128

Re: [Ntop-misc] nscrub

Hi Spiros I will send you the documentation. Alfredo > On 24 Oct 2017, at 14:16, Spiros Papageorgiou wrote: > > Hi all, > > I have installed nscrub and i'm trying to configure it. I haven't found a > config guide at ntopng site. Is there a guide somewhere for nscrub? > > I would like to setu

Re: [Ntop-misc] pf_ring: bug fix (rule inactivity)

Hi Amir here you go: https://github.com/ntop/PF_RING/commit/8d04b242b48902600393e12209a758c4a84ec825 Please send a pull request for the next patch. Thank you Alfredo > On 18 Oct 2017, at 19:38, Amir Kaduri wrote: > > Hi Alfredo, > > The attached patch includes a fix of a bug that relates to

Re: [Ntop-misc] Multiple ZC Captures

edo, > > Thank you. Is there documentation on zbalance beyond what I'm finding via > Google? I'm not seeing how to use it to create the queues for Tcpdump to > attach to. > > -Terry > > > On Friday, September 29, 2017 1:05 PM, Alfredo Cardigliano > wrot

Re: [Ntop-misc] Multiple ZC Captures

puts to dummy interfaces which are then used by the > application. Is this how we would do it -- set up one-to-one mappings of ZC > Interface -> Dummy Interface, and then have users use the dummy interfaces > with tcpdump rather than the ZC interfaces directly? > > -Terry &g

Re: [Ntop-misc] Multiple ZC Captures

Hi Terry ZC is a kernel-bypass technology, this means that the application takes full control over the NIC in order to access the card memory in zero-copy and maximise the performance. This implies that one process at a time can open an interface, thus what you are seeing with tcpdump is expecte

Re: [Ntop-misc] pfring.h

link file in /usr/include/pfring.h which points to > /usr/local/include/pfring.h - no help. > > Thanks > James > > On 18 September 2017 at 18:08, Alfredo Cardigliano <mailto:cardigli...@ntop.org>> wrote: > This is strange, actually if you have pfring installed in

Re: [Ntop-misc] pfring.h

/configure --with-libpfring-includes=/usr/local/include > --with-pfring-kernel-includes=/usr/local/include > --with-libpfring-libraries=/usr/local/lib > > > On 18 September 2017 at 11:03, Alfredo Cardigliano <mailto:cardigli...@ntop.org>> wrote: > Please specify all of them

  1   2   3   4   5   6   7   8   9   10   >