[Ntop-misc] How to get pf_ring packets filtering statistics

[Amir Kaduri]

Hi,

In my application, I’m using pf_ring hash software filters (API:
pfring_handle_hash_filtering_rule()).

How can I get statistics info regarding the quantity of the filtered
packets?

I know that on ixgbe module, I can get the following parameters when using
ethtool –s :

fdir_match, fdir_miss, fdir_overflow.

Are there any pf_ring user-space APIs to get these parameters? Any code
examples?



Thanks,

Amir
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc

Re: [Ntop-misc] How to get pf_ring packets filtering statistics

[Alfredo Cardigliano]

Hi Amir
there is no statistics by default (unless you code your own kernel plugin and 
read stats via pfring_get_hash_filtering_rule_stats, but this is overkilling 
for match/miss counters),
please open a feature request on github.

Alfredo

> On 09 Nov 2015, at 18:28, Amir Kaduri  wrote:
> 
> Hi,
> 
> In my application, I’m using pf_ring hash software filters (API: 
> pfring_handle_hash_filtering_rule()).
> 
> How can I get statistics info regarding the quantity of the filtered packets?
> 
> I know that on ixgbe module, I can get the following parameters when using 
> ethtool –s :
> 
> fdir_match, fdir_miss, fdir_overflow.
> 
> Are there any pf_ring user-space APIs to get these parameters? Any code 
> examples?
> 
>  
> 
> Thanks,
> 
> Amir
> 
> ___
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc

___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc

Re: [Ntop-misc] N2DISK Error

[Yuri Francalacci]

If there is no output the module is not loaded. 
The command you have to run if in the init.d directory is
./pf_ring start
Or even better use the full path as said  in the previous mail.
Yuri

###
Yuri Francalacci   -   y...@ntop.org   -   http://www.ntop.org
"Simplicity is the ultimate sophistication" - Leonardo da Vinci
###

> On 09 Nov 2015, at 09:46, Ohad Kleinman  wrote:
> 
> Yuri,
> Indeed when running at system console # lsmod | grep pf_ring no output.
>  
> I tried starting the pf_ring but got the following error:
>  
> /etc/init.d# pf_ring start
> pf_ring: command not found
>  
> looking in the ntop services web GUI I see that pf_ring is running.
>  
> https://dl.dropboxusercontent.com/u/27973370/pf_ring.jpg 
> 
>  
>  
> What am I missing?
>  
> Thanks.
>  
> Ohad
>  
>  
> 
> ___
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc

___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc

Re: [Ntop-misc] Maximum limit of pfring_open

[K Rahul]

On 11/06/2015 08:31 PM, Alfredo Cardigliano wrote:

Rahul
do you really need all those sockets, it looks like a bad design choice.

Alfredo


On 06 Nov 2015, at 15:59, K Rahul  wrote:

On 11/05/2015 05:29 PM, K Rahul wrote:

On 11/04/2015 08:58 PM, Alfredo Cardigliano wrote:

Hi Rahul
you should increase MAX_NUM_RING_SOCKETS in kernel/linux/pf_ring.h,
currently it is set to 128.

Alfredo


On 04 Nov 2015, at 16:00, K Rahul  wrote:

Hi,

we are using pfring to capture multicast packets. We are not using DNA or ZC 
drivers as our NIC does not support the same.We are using Broadcom Netxtreme 
BCM5721 NIC. If I use pfring_open more than 64 times, i.e  pfring_open is 
called for 64 different multicast streams, then it returns a NULL. Is there any 
limit to pfring handles? If there is a limit, how can I increase it?

Thanks

Regards,
Rahul
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc

___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc

Thank you for the prompt reply
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc

Hi,

We have increased the limit of MAX_NUM_RING_SOCKETS to 128 from 64. Now, after 
opening 50 handles and more we are observing packet drops. Is there any other 
variable that need to be handle to capture all the packets?

Thank you

Regards,
K Rahul
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc

___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc

Hi,

Let me explain you the use of pfring in our module. We are using pfring 
to capture mpeg2ts streams over multicast. We can have multiple 
multicast streams joined and each one of these streams uses one pfring 
handle. Thus as per our current design, if we need to capture 100 
multicast streams, we will require 100 pfring sockets, each with a 
specific bpf filter like "udp and dst port  and src host 
(172.16.0.10) and dst host 239.99.99.99".


The reason for choosing such a model is that our module can join or 
leave multicast streams in runtime.For ex, if we are capturing a 
multicast stream, we set the bpf filter specific to the stream. Now, in 
case we need to capture another multicast stream using the same pfring 
handle, we will need to modify the bpf filter at runtime. As per our 
current understanding, this is not feasible. Thus, we decided to use one 
pfring socket per multicast stream.


It would be very helpful if you can suggest any alternative approach.

Thank you

Regards,
K Rahul
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc

Re: [Ntop-misc] N2DISK Error

[Ohad Kleinman]

Yuri,

Indeed when running at system console # lsmod | grep pf_ring no output.



I tried starting the pf_ring but got the following error:



/etc/init.d# pf_ring start

pf_ring: command not found



looking in the ntop services web GUI I see that pf_ring is running.



https://dl.dropboxusercontent.com/u/27973370/pf_ring.jpg





What am I missing?



Thanks.



Ohad





*From:* ntop-misc-boun...@listgateway.unipi.it [mailto:
ntop-misc-boun...@listgateway.unipi.it] *On Behalf Of *Yuri Francalacci
*Sent:* Sunday, November 08, 2015 6:26 PM
*To:* ntop-misc@listgateway.unipi.it
*Subject:* Re: [Ntop-misc] N2DISK Error



connect to the system console and run



# lsmod | grep pf_ring



If there is no output, this means that the the pf_ring module is not
loaded, hence you have to run (at least)



# /etc/init.d/pf_ring start

Once loaded the module (re-run the lsmod as above), retry the n2disk
program.



Yuri

###
Yuri Francalacci   -   y...@ntop.org   -   http://www.ntop.org
"Simplicity is the ultimate sophistication" - Leonardo da Vinci
###



On 08 Nov 2015, at 16:55, Ohad Kleinman  wrote:



We have an Ubuntu machine with Nbox software that includes nprobe, Ntopng,
n2disk stc.



The n2disk used to work for us, but now when starting the n2disk after few
seconds the status is changed to off. When looking in the log file I can
see the following lines:



08/Nov/2015 17:39:49

WARNING: Invalid license found for A2F3EC4D9206AAF2

08/Nov/2015 17:39:49

WARNING: (See /etc/n2disk10g.license) [Missing license file]

08/Nov/2015 17:39:49

WARNING: ***

08/Nov/2015 17:39:49

WARNING: ** **

08/Nov/2015 17:39:49

WARNING: ** Switching to DEMO MODE due to license error **

08/Nov/2015 17:39:49

WARNING: ** **

08/Nov/2015 17:39:49

WARNING: ***

08/Nov/2015 17:39:49

WARNING: ** Dumping will stop after 5 min **

08/Nov/2015 17:39:49

WARNING: ***

08/Nov/2015 17:39:49

Welcome to n2disk10g v.2.3.151021 (r4451)

08/Nov/2015 17:39:49

Running on 1 node(s) system with 4 core(s). NUMA affinity set to node 0.

08/Nov/2015 17:39:49

Using PF_RING for packet capture

08/Nov/2015 17:39:49

Multithread support enabled

08/Nov/2015 17:39:49

Dump files max size is set to 16 MB

08/Nov/2015 17:39:49

Max number of packets per file set to 1

08/Nov/2015 17:39:49

Buffer memory is set to 128 MB (8 pcap files buffer)

08/Nov/2015 17:39:49

Using directory /storage/n2disk/eth1 for dump files

08/Nov/2015 17:39:49

Up to 5 sub-directories will be created

08/Nov/2015 17:39:49

Up to 50 files will be written before overwriting

08/Nov/2015 17:39:49

Dump files max duration is set to 60 sec

08/Nov/2015 17:39:49

Dumping data in 4.0 MB chunks

08/Nov/2015 17:39:49

Memory allocated successfully

08/Nov/2015 17:39:49

Using kernel packet timestamps

08/Nov/2015 17:39:49

ERROR: Unable to open PF_RING device eth1 [globals.ro.snaplen=1518]

08/Nov/2015 17:39:49

ERROR: Unable to initialize packet reader

08/Nov/2015 17:39:49

ERROR: Has the pf_ring kernel module been loaded ?



The nProbe is working well without any problems.





Any ideas what has happened?





Thanks

Ohad





___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc