date:20161106

[Ntop-misc] Trying to get plugins to work - not enabled

2016-11-06 Thread John Marshall

I originally thought it was a license issue, but now that I've installed the 
license, it still does not work.  Says "License Ok" so I'm assuming the license 
is correctly installed.

nprobe -E "0:3" -f "tcp and port 80" -a -n 10.65.24.57:2055 -i ens4 -u 1 -Q 2 
-t 60 -d 15 -V 10 -T "%IPV4_SRC_ADDR %IPV4_DST_ADDR %IPV4_NEXT_HOP %INPUT_SNMP 
%OUTPUT_SNMP %IN_PKTS %L4_DST_PORT %L4_SRC_PORT %IN_BYTES 
%FLOW_START_MILLISECONDS %FLOW_END_MILLISECONDS %PROTOCOL %IPV4_SRC_MASK 
%IPV4_DST_MASK %IN_SRC_MAC %OUT_DST_MAC %TCP_FLAGS %CLIENT_NW_DELAY_MS 
%SERVER_NW_DELAY_MS %APPL_LATENCY_MS %HTTP_URL %HTTP_RET_CODE %HTTP_REFERER 
%HTTP_UA %HTTP_MIME"
07/Nov/2016 15:45:58 [nprobe.c:3450] Valid nProbe Pro license found
07/Nov/2016 15:45:58 [plugin.c:174] No plugins found in ./plugins
07/Nov/2016 15:45:58 [plugin.c:182] Loading 24 plugins [.so] from 
/usr/local/lib/nprobe/plugins
07/Nov/2016 15:45:58 [plugin.c:784] Unable to enable plugin DHCP Protocol 
[/etc/nprobe.license.dhcp]: License Ok
07/Nov/2016 15:45:58 [plugin.c:784] Unable to enable plugin Diameter Protocol 
[/etc/nprobe.license.diameter]: License Ok
07/Nov/2016 15:45:58 [plugin.c:784] Unable to enable plugin DNS/LLMNR Protocol 
[/etc/nprobe.license.dns]: License Ok
07/Nov/2016 15:45:58 [plugin.c:784] Unable to enable plugin Export Plugin 
[/etc/nprobe.license.export]: License Ok
07/Nov/2016 15:45:58 [plugin.c:784] Unable to enable plugin FTP Protocol 
[/etc/nprobe.license.ftp]: License Ok
07/Nov/2016 15:45:58 [plugin.c:784] Unable to enable plugin GTPv0 Signaling 
Protocol [/etc/nprobe.license.gtpv0]: License Ok
07/Nov/2016 15:45:58 [plugin.c:784] Unable to enable plugin GTPv1 Signaling 
Protocol [/etc/nprobe.license.gtpv1]: License Ok
07/Nov/2016 15:45:58 [plugin.c:784] Unable to enable plugin GTPv2 Signaling 
Protocol [/etc/nprobe.license.gtpv2]: License Ok
07/Nov/2016 15:45:58 [plugin.c:784] Unable to enable plugin HTTP Protocol 
[/etc/nprobe.license.http]: License Ok
07/Nov/2016 15:45:58 [plugin.c:784] Unable to enable plugin IMAP Protocol 
[/etc/nprobe.license.email]: License Ok
07/Nov/2016 15:45:58 [plugin.c:784] Unable to enable plugin Netflow-Lite Plugin 
[/etc/nprobe.license.nflite]: License Ok
07/Nov/2016 15:45:58 [plugin.c:784] Unable to enable plugin Oracle Protocol 
[/etc/nprobe.license.oracle]: License Ok
07/Nov/2016 15:45:58 [plugin.c:784] Unable to enable plugin POP3 Protocol 
[/etc/nprobe.license.email]: License Ok
07/Nov/2016 15:45:58 [plugin.c:784] Unable to enable plugin System process 
information [/etc/nprobe.license.process]: License Ok
07/Nov/2016 15:45:58 [plugin.c:784] Unable to enable plugin Radius Protocol 
[/etc/nprobe.license.radius]: License Ok
07/Nov/2016 15:45:58 [plugin.c:784] Unable to enable plugin RTP Plugin 
[/etc/nprobe.license.voip]: License Ok
07/Nov/2016 15:45:58 [plugin.c:784] Unable to enable plugin S1AP Protocol 
[/etc/nprobe.license.S1AP]: License Ok
07/Nov/2016 15:45:58 [plugin.c:784] Unable to enable plugin SIP Plugin 
[/etc/nprobe.license.voip]: License Ok
07/Nov/2016 15:45:58 [plugin.c:784] Unable to enable plugin SMTP Protocol 
[/etc/nprobe.license.email]: License Ok
07/Nov/2016 15:45:58 [nprobe.c:5064] Welcome to nProbe Pro v.7.5.161106 
($Revision: 5466 $) for x86_64-unknown-linux-gnu with native PF_RING 
acceleration
07/Nov/2016 15:45:58 [nprobe.c:5074] Running on CentOS Linux release 7.2.1511 
(Core)
07/Nov/2016 15:45:58 [nprobe.c:5085] [LICENSE] nProbe SystemId: 12FBFEEB0749
07/Nov/2016 15:45:58 [nprobe.c:7422] Welcome to nProbe v.7.5.161106 for 
x86_64-unknown-linux-gnu
07/Nov/2016 15:45:58 [nprobe.c:6506] Using NetFlow Packet Payload Len: 1472
07/Nov/2016 15:45:58 [template.c:1585] WARNING: Unable to locate template 
'CLIENT_NW_DELAY_MS'. Discarded.
07/Nov/2016 15:45:58 [template.c:1585] WARNING: Unable to locate template 
'SERVER_NW_DELAY_MS'. Discarded.
07/Nov/2016 15:45:58 [template.c:1585] WARNING: Unable to locate template 
'HTTP_URL'. Discarded.
07/Nov/2016 15:45:58 [template.c:1585] WARNING: Unable to locate template 
'HTTP_RET_CODE'. Discarded.
07/Nov/2016 15:45:58 [template.c:1585] WARNING: Unable to locate template 
'HTTP_REFERER'. Discarded.
07/Nov/2016 15:45:58 [template.c:1585] WARNING: Unable to locate template 
'HTTP_UA'. Discarded.
07/Nov/2016 15:45:58 [template.c:1585] WARNING: Unable to locate template 
'HTTP_MIME'. Discarded.
07/Nov/2016 15:45:58 [template.c:1585] WARNING: Unable to locate template 
'CLIENT_NW_DELAY_MS'. Discarded.
07/Nov/2016 15:45:58 [template.c:1585] WARNING: Unable to locate template 
'SERVER_NW_DELAY_MS'. Discarded.
07/Nov/2016 15:45:58 [template.c:1585] WARNING: Unable to locate template 
'HTTP_URL'. Discarded.
07/Nov/2016 15:45:58 [template.c:1585] WARNING: Unable to locate template 
'HTTP_RET_CODE'. Discarded.
07/Nov/2016 15:45:58 [template.c:1585] WARNING: Unable to locate template 
'HTTP_REFERER'. Discarded.
07/Nov/2016 15:45:58 [template.c:1585] WARNING: Unable to locate template 
'HTTP_UA'. Discarded.
07/Nov/2016 15:45:58 [template.c:1585] WARNING:

Re: [Ntop-misc] zcount displays less packets in zc mode

2016-11-06 Thread Moshe Danielli

Hi Alfredo,
Thanks for the info !
A few follow up questions, if I may:
1. Out of curiosity, if interrupts aren't a part of the game in ZC, how are packets dequeued from the shared memory ? on-going polling / NAPI (hope I'm using the right technical term) ?
2. Thanks for the reference ! What should I do in case I'm using a 3rd party IDS app, whose source code isn't available ? should I use taskset to pin the process to a specific core ?
Your help is much appreciated !

On Nov 3, 2016 19:39, Alfredo Cardigliano wrote:On 3 Nov 2016, at 18:07, Moshe Danielli wrote:Hi Alfredo,
1. There's no point in distributing the interrupts as the user threads read directly from the NIC's memory ?Yes, we avoid using poll/interrupts, and the application is directly accessing NIC’s memory without going through the kernel with ZC, thus you should not worry much about interrupts.
2. Can you give an example / reference to bounding the threads to different cpu cores ?Sure, take a look at https://github.com/ntop/PF_RING/blob/dev/userland/examples_zc/zbalance.c-r and -g options, or search for bind2core() inside the code.Alfredo
Thanks again !
On Nov 3, 2016 17:54, Alfredo Cardigliano wrote:Hi Mosheplease note you can just ignore interrupts with ZC, just make sure you application threads are bound to the correct CPU cores in order to correctly spread the load.AlfredoOn 2 Nov 2016, at 15:38, Moshe Danielli wrote:
I understand... However, can we control the irq / core distribution of flows as we can with RSS (using smp_affinity)?
On Nov 2, 2016 15:56, Alfredo Cardigliano wrote:

Hi Moshe
RSS is an IP-based (IP+port for TCP) hw hash, if you need something more flexibly (e.g. a custom hash function) then you need zbalance_ipc.
Alfredo

On 2 Nov 2016, at 14:06, Moshe Danielli wrote:

Hi Alfredo,
1. You were abosutely right - that was the exact reason. Once I switched to single queue mode, everything worked as expected.
2. Given Intel's RSS functionality - what is zbalance_irq doing different ? Why should I use it instead of making use of RSS ?
Thanks !
On Nov 2, 2016 12:03, Alfredo Cardigliano wrote:

Hi Moshe
do you have RSS enabled perhaps?
Please read the documents below:
https://github.com/ntop/PF_RING/blob/dev/doc/README.RSS
https://github.com/ntop/PF_RING/blob/dev/doc/README.apt_rpm_packages
Alfredo

On 2 Nov 2016, at 11:00, Moshe Danielli wrote:

Hi Everyone,
I'm experiencing a weird situation where I'm running zcount twice:
1. zcount -i zc:em1
2. zcount -i em1
the first execution (zc mode) produces a count value of about 0.5 gbps while the 2nd execution (non zc mode) produces a value of about 4.5 gbps.
How is that possible ? what am I doing wrong ?
i'm using version 6.4.1-stable with 4096 ring slots and an intel 10g device (intel ixgbe 82599) on ubuntu 14.04.
Thanks in advance

___Ntop-misc mailing listNtop-misc@listgateway.unipi.ithttp://listgateway.unipi.it/mailman/listinfo/ntop-misc

___Ntop-misc mailing listNtop-m...@listgateway.unipi.ithttp://listgateway.unipi.it/mailman/listinfo/ntop-misc

___Ntop-misc mailing listNtop-misc@listgateway.unipi.ithttp://listgateway.unipi.it/mailman/listinfo/ntop-misc

___Ntop-misc mailing listNtop-m...@listgateway.unipi.ithttp://listgateway.unipi.it/mailman/listinfo/ntop-misc

___Ntop-misc mailing listNtop-misc@listgateway.unipi.ithttp://listgateway.unipi.it/mailman/listinfo/ntop-misc___Ntop-misc mailing listNtop-m...@listgateway.unipi.ithttp://listgateway.unipi.it/mailman/listinfo/ntop-misc___Ntop-misc mailing listNtop-misc@listgateway.unipi.ithttp://listgateway.unipi.it/mailman/listinfo/ntop-misc___Ntop-misc mailing listNtop-m...@listgateway.unipi.ithttp://listgateway.unipi.it/mailman/listinfo/ntop-misc___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc

[Ntop-misc] Trying to get plugins to work - not enabled

Re: [Ntop-misc] zcount displays less packets in zc mode

2 matches

Site Navigation

Mail list logo

Footer information