Rex
Can you explain how to reproduce this problem? What system are you using and
how the card is connected with the CPU?
regards Luca
Sent from my iPad
On 01/set/2011, at 06:10, rex.huangc rex.hua...@gmail.com wrote:
I test TNAPI driver 2.4.12.
The performance is very low. About
Chris
just to understand: the problem appears only if your use the e1000-PF_RING
driver, whereas with PF_RING and the vanilla driver everything works?
Luca
On Aug 26, 2011, at 1:31 PM, Chris Wakelin wrote:
I've got a couple of (probably related) problems with PF_RING 4.7.2
1) With
Charles
your NIC is not recognized by the DNA driver. Can you please tell me the exact
card model you own?
Thanks Luca
On Aug 24, 2011, at 3:28 AM, Charles Wright wrote:
I am trying to run the pfcount example using DNA against a Silicom card.
This is my Silicom interface:
$ ifconfig eth14
Hi all
You can go on sourceforge where we host ntop, nag get pas PF_RING versions there
Luca
Sent from my iPad
On 20/ago/2011, at 10:39, Chris Wakelin c.d.wake...@reading.ac.uk wrote:
It's not a normal link; you need to install a Subversion client (svn).
apt-get install subversion should
Rex
Please fill a bug on http://bugzilla.ntop.org and add the full kernel trace as
well as a way to reproduce it. I will look at it as soon as I come back from
vacation.
Luca
Sent from my iPad
On 19/ago/2011, at 10:11, rex.huangc rex.hua...@gmail.com wrote:
hi, luca
Report a bug.Our
Hi Andrew
nice to hear from you. The figures you have are bad, as in total you
capture too little. Typical figures are shown here
http://www.ntop.org/blog/pf_ring/packet-capture-performance-at-10-gbit-pf_ring-vs-tnapi/
I suggest to go for DNA as it is both fast and CPU savvy (see
Of *Luca Deri
*Sent:* Friday, August 12, 2011 1:42 PM
*To:* ntop-misc@listgateway.unipi.it
*Subject:* Re: [Ntop-misc] X520 what options for higher throughput
with pfcount_multichannel?
Hi Andrew
nice to hear from you. The figures you have are bad, as in total you
capture too little. Typical
...@listgateway.unipi.it] *On Behalf Of *Luca Deri
*Sent:* Friday, August 12, 2011 1:57 PM
*To:* ntop-misc@listgateway.unipi.it
*Subject:* Re: [Ntop-misc] X520 what options for higher throughput
with pfcount_multichannel?
Andrew
1. how did you insmod the pf_ring/ixgbe module (I mean what
to see what it is supposed to be doing
Thanks,
Andrew
*From:*ntop-misc-boun...@listgateway.unipi.it
[mailto:ntop-misc-boun...@listgateway.unipi.it] *On Behalf Of *Luca Deri
*Sent:* Friday, August 12, 2011 2:20 PM
*To:* ntop-misc@listgateway.unipi.it
*Subject:* Re: [Ntop-misc] X520 what
.
Packet drop is still around 2% when using load.sh to insmod DNA driver.
pfsend is working after resync.
Thanks,
David.
On 9 August 2011 22:00, Luca Deri d...@ntop.org wrote:
Hi David
On Aug 9, 2011, at 11:40 AM, David Kwan wrote:
Dear Luca,
I use 2 different machines
Hi Andrew
the answer is yes and you can also export the VLAN tags
[ 58] %SRC_VLAN %vlanId Source VLAN
[ 59] %DST_VLAN %postVlanId Destination VLAN
Regards Luca
On Aug 10, 2011, at 1:56 AM, Andrew Pollock wrote:
Hi,
David
the only thing you have to do is use the device name dan:ethX if you want,
otherwise the system detects it for you
Performance. You are sending and receiving from the same PC using two different
ports, correct? Below you have listed the CPU, but at these speeds the chipset
you have and
]---
Thanks,
David.
On 9 August 2011 15:03, Luca Deri d...@ntop.org wrote:
David
the only thing you have to do is use the device name dan:ethX if you want,
otherwise the system detects it for you
Performance. You are sending and receiving from the same PC using two
different ports, correct
Arsham
you need to get the source code of PF_RING and compile it. If you use the ARM
version of OpenWrt I would be pleased you to send us any problem you might
encounter
Luca
On Aug 3, 2011, at 10:32 AM, Arsham Farshad wrote:
Hi all,
I was wondering, does any one know where can I get the
not sure that I understand why the performance that I'm seeing for the
PF_RING enabled libpcap is so much worse (more than an order of
magnitude slower) than vanilla pcap. Do you have any idea why this
would be?
=s=
On Tue, Aug 2, 2011 at 1:55 AM, Luca Deri d...@ntop.org wrote:
Sally
my
Sally
my fault. I was thinking about pfbounce.c (not pfreflect.c) sorry. As
you can see we are doing everything in kernel, but I'm not sure this is
what you need.
In fact if you want to do everything in user-space you should completely
bypass the stack and speak with the NIC. PF_PACKET has a
Sally
now I understand. You have created a bridge in user-space. With the DNA you can
achieve 10G wire rate but on standard PF_RING you pay the fact that on TX
PF_RING makes a syscall per packet. If you want to do this efficiently you need
to look at the code of
Jeremy
as pfcount warns you we have tested our code with Intel-based Silicom NICs, so
using Intel NICs you cannot enable DNA. Elad (in cc to this email) from Silicom
can offer you a replacement for your card.
At the same time, can you please tell me whether you used the code in SVN of
the
Sally
can you please share the code with me (you can send me a private email if you
want) so I can see myself how you used PF_RING and if we need to change
something in libpcap-over-PF_RING ?
Thanks Luca
On Jul 29, 2011, at 3:11 AM, Sally Bird wrote:
As part of a research project, we've
.
Best Wishes,
Yuta
(2011/07/20 19:25), Luca Deri wrote:
Yuta
nprobe -h prints the fields you can use in exported flows. As for ASA you
are using nprobe in collector mode, thus these ASA-only fields are supported
in collection and not in flow export.
Regards Luca
On Jul 19
Robert
Please fill a bug on bugzilla.ntop.org so we can track this issue. Please
attach a pcap file we can use to reproduce the bu
Thanks Luca
Sent from my iPad
On 19/lug/2011, at 03:39, Yamamoto Robert-P20848 robert.yamam...@nsn.com
wrote:
Hi,
I am modifying the dummy plugin to look
Joe
This needs to be fixed. Please file a bug report for it, on
http://bugzilla.ntop.org
Thanks Luca
Sent from my iPad
On 18/lug/2011, at 22:23, Joe Damato ice...@gmail.com wrote:
Hi -
I noticed that the fragments information element is written to the
flow record buffer as a 16bit
Alan
in fastbit you should be dumping interface Ids (numbers I mean) so you should
query the numeric InterfaceId. Unfortunately on fastbit only numbers are
supported
Regards Luca
On Jul 11, 2011, at 1:20 PM, Alan Kemp wrote:
Hey Guys
We have a requirement to translate the snmp ifIndex in
Alan
please file a bug on http://bugzilla.ntop.org
Luca
On Jul 11, 2011, at 1:18 PM, Alan Kemp wrote:
Hey Guys
Running nprobe 6.5.0, fastbit version 1.2.4 as a collector for cisco version
9 netflow, on ubuntu Linux (natty)
When dumping the flows into fastbit the LAST_SWITCHED and
Hi Rui
On 05/lug/2011, at 03:25, Rui wireles...@gmail.com wrote:
hi
can I use pf_ring in commercial SW?
Yes
pf_ring kernel module is GPL,
Yes
pf_ring lib will be linked with the commercial SW,and the commercial
SW want to stay in closed source code
Yes
is there any problem? what
Hong
the DAQ module should work in inline mode
Luca
On Jun 20, 2011, at 1:21 AM, h...@metaflows.com wrote:
Hello,
Does anyone know if I can run Snort inline like this?
snort -Q --daq pfring --daq-mode inline -i eth0:eth1 -c snort.conf
I can run it with afpacket like:
snort -Q --daq
Joe
Template export is done periodically. What you suggest make send however and I
will take care of implementing it in the next release. Please file a bug as
reminder in bugzilla.ntop.org
Regards Luca
On 19/giu/2011, at 01:21, Joe Damato ice...@gmail.com wrote:
Hi -
I am using nprobe
Hi all
if you are willing to test the 10 Gbit DNA driver, it's now time to do it. We
have just released PF_RING 4.7.0 that includes this new driver offered at no
cost by Silicom, who has sponsored its development. Silicom is also offering
evaluation adapters at no cost to all those willing to
Kevin
it looks to me that there's a lock that is not released and that causes this
problem. it might be that is the clustering you use.
Can you please explain how you started snort?
Please file a bug on bugzilla.ntop.org for tracking this issue
Regards Luca
On Jun 16, 2011, at 6:53 PM, Kevin
not resolve, though
https://www.ntop.org/bugzilla3/ works fine.
Kevin
On 6/14/2011 3:13 AM, Alfredo Cardigliano wrote:
2011/6/14 Rui wireles...@gmail.com
On Thu, May 26, 2011 at 5:19 PM, Luca Deri d...@ntop.org wrote:
Rui
can you please file a bug on http://bugzilla.ntop.org so we
Hi Jaime
On 07/giu/2011, at 09:23, Jaime Nebrera jnebr...@eneotecnologia.com wrote:
Hi Luca,
1G DNA is not an issue with any modern PC, from dual-core upwards
I have used core2duo and up. I can't comment on atom. Anyway beside packet
capture you have to process packets so the final
/30/2011 10:27 AM, Luca Deri wrote:
Daniel
this is how to do it (nprobe -h)
Note on interface indexes and (router) MAC/IP addresses
---
Flags -u and -Q are used to specify the SNMP interface identifiers for
emitted flows.
However using
Hi all
I would like to invite you to a free NetFlow-Lite webinar that will happen
later this week. As you know NetFlow lite is supported in nProbe and it will
also be supported in ntop later this summer. For more information, please visit
Rui
can you please file a bug on http://bugzilla.ntop.org so we track this problem?
Luca
On May 24, 2011, at 9:19 AM, Rui wrote:
hi
when I use the below script to stop pfcount, the system got hang(or
crash), and there is no any trace and kerboard response.
the problem happens almost
Marcio
Please use the SVN code
Luca
On May 25, 2011, at 10:02 PM, Marcio Araujo wrote:
Luca,
When I start PF_RING 4.6.3 with the compiled IGB Driver, and
Transparent_Mode=2, my application get all the dumps from the NIC, but it
doesn't create the rings file (ie:
Maurizio
you can also use MAC addresses in addition to IPs. If you have a better
suggestion for doing that, I am here to listen
Luca
On May 26, 2011, at 9:47 AM, Maurizio Molina wrote:
with nprobe, the direction of traffic on an interface cannot be inferred if
not on the basis of IP
Alan
are you using version 6.5? I have tested on OSX (BSD-based) and it works for me
Luca
On May 25, 2011, at 2:23 PM, Alan Kemp wrote:
Hey Guys
I have been struggling to get nprobe running on FreeBSD 8.2-RELEASE.
I just want to start nprobe as a netflow v9 collector running on port
Daniel
In the current version you can set the watermark (default is 128) for doing it.
There is an API call for that. Have a look at pfcount for an example.
Cheers Luca
On 20/mag/2011, at 20:46, Daniel, Christopher
chris.dan...@visualnetworksystems.com wrote:
Luca,
Is there an
be a problem, even if some are on CPU 0 and
others on CPU 1?
The drops can be seen in rx_missed_errors from ethtool -S or drop from
/proc/net/dev
These drops also happen when I dont set the params enable_ip_defrag=1
min_num_slots=24000 for pfring.
Jonathan
On 17 May 2011 20:32, Luca Deri d
Christopher
the e1000e driver and the e1000 are not so different but definitively
different. it;s not a simple patch and with the e1000 you can capture ~1.2 Mpps
but not wire rate this unless you have some specific chipset 82546 for instance
as the e1000 family is very large. The new igb series
Christopher
soon we'll release vPF_RING designed by Alfredo for addressing VM packet
capture. As you can read on http://luca.ntop.org/Teaching/Cardigliano.pdf the
point is that VMs (or at least kvm) are inefficient as their virtual NICs are
basically a queue where packets are added/removed. If
Mario
these are binary dump files similar to those produced by flow-tools. We dump
the flow as is.
Luca
On May 19, 2011, at 5:43 PM, Mario Weckauf wrote:
Hi folks,
how can I read, open, analyze or convert the .flow dump files from the
Netflow-Plugin?
Greetings Mario
Daniel
I have committed the fix many thanks
Luca
On May 18, 2011, at 4:39 AM, Daniel, Christopher wrote:
Hi Luca,
I'm using kernel 2.6.18-238.9.1.el5
I get a compile error when I try to build the kernel. Please see the fix and
let me know if this is OK.
make[1]: Entering directory
programs dont set the thread affinity
to the SMT hyperthread for the same core which the RX queue has been
assigned. This only makes a difference at higher rates but not at 1Gbit in my
current system?
Regards
Jonathan
On 16 May 2011 20:38, Luca Deri d...@ntop.org wrote:
Jonathan
Jonathan
I have forgot to say that the CPU was loaded ~50% when capturing at over 11
Mpps. This is also important if you plan to do something with these packets
beside just counting them.
Luca
On May 16, 2011, at 6:45 PM, Luca Deri wrote:
Hi Jonathan
On May 16, 2011, at 3:23 PM, Lynch
,
Based on your blog entry, do you know up to what rates the TNAPI driver can
perform lossless capture...ie 0% packet loss?
Sounds like the DNA driver is progressing nicely then. Thats nearly wire rate
for 64 byte packets
Regards
Jonathan
On 16 May 2011 17:49, Luca Deri d...@ntop.org wrote
Chris
please find a bug on http://www.ntop.org/bugzilla3/ and we'll track it
Luca
On May 16, 2011, at 7:17 PM, Chris Wakelin wrote:
Hi,
I've got a long-standing annoying problem with PF_RING; if I use a
libpcap application with a host or net filter it seems only to
capture one side of the
Archana
we can support on PF_RING but not on non-PF_RING apps. Thus if you can boil
down this problem to something we can do on the PF_RING size we would be
willing to help you
Luca
On May 14, 2011, at 6:16 AM, Archana N wrote:
Hi,
I configured justniffer application to be used with
Hi all
the transparent mode diverts all packets to PF_RING only, if and only if, you
have a PF_RING enabled application running when/simultaneously you start your
non-PF_RING tcpdump. Is this your case?
Regards Luca
On May 13, 2011, at 6:10 PM, Chris Wakelin wrote:
Looks like they're
Rui
my colleague Alfredo is working at memory alignment, so I think he should speak
about that.
Alfredo; what's you opinion?
Luca
On May 9, 2011, at 10:23 AM, Rui wrote:
hi luca:
regarding this data structure,when I compiled it at a 64bit machine,
the tot_fwd_notok offset is 64 Bytes
Archana
do rm /usr/local/lib/libpcap.so (but check that /usr/local/lib/libpcap.a is
present) and recompile your app. You might have various libpcap versions
installed
Luca
On May 6, 2011, at 2:06 AM, Archana N wrote:
Hi,
I am trying to configure pf_ring with
Piotr
Looks like a bug. Can you please create a pcap file I an use to reproduce it
without the need to install tc? Please file a bug and attach such pcap file on
http://www.ntop.org/bugzilla3/
Thanks Luca
On 21/apr/2011, at 21:21, Piotr Romanus proma...@crossbeamsys.com wrote:
I wonder if
Daniel
if you have 100k concurrent flows, -w 256000 will do the job
Luca
On Apr 19, 2011, at 3:24 PM, Daniel Aschwanden wrote:
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
Hi all,
I'm still struggling with the hash of nprobe (version 6.3.0).
Luca suggested to increase the hash
Daniel
it looks your traffic is not easy balance-able then. What kind of packets are
you using?
Luca
On Apr 19, 2011, at 5:53 PM, Daniel Aschwanden wrote:
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
Hi Luca,
On 04/19/2011 05:33 PM, Luca Deri wrote:
Daniel
if you have 100k
Hi
Please update from svn: this problem should already be fixed
Luca
On 04/apr/2011, at 12:33, 王勇 wangyon...@tsinghua.org.cn wrote:
Dear all,
I am a newbie to pf ring and kernel program. I added several lines follow the
calling of add_skb_to_ring in pf_ring/kernel/pf_ring.c to do
VIncent
at the moment, we offer only physical nboxes or the basic software (ntop.
nprobe).
Regards Luca
On Apr 4, 2011, at 8:54 PM, vinc...@ragosta.net wrote:
Is the nbox86 firmware image still available for download? I can't seem to
locate it.
Thanks.
Vincent
Hi all
those interested in tuning nProbe performance, should look at this
http://www.ntop.org/blog/?p=375
Luca
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
, Luca Deri wrote:
Hi all
those interested in tuning nProbe performance, should look at this
http://www.ntop.org/blog/?p=375
Luca
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
On Apr 3, 2011, at 7:56 PM, Michael Hsu wrote:
It's still rather unclear to me, is it supposed to be Gbit/s of traffic?
No: Mpps (million packets x second)
I think explicitly labeling the X axis would remove any uncertainty.
ok
Luca
On Sun, 2011-04-03 at 19:13 +0200, Luca Deri wrote
Daniel
see http://www.ntop.org/blog/?p=363
Cheers Luca
On Mar 28, 2011, at 12:11 PM, Daniel Aschwanden wrote:
Hi together,
I'd like to know if nProbe is capable of exporting netflow probes over
another transport protocol as UDP, i.e. TCP or SCTP?
If yes, how can I do that?
Thanks for
Yann
I forgot to mention that the 82576 filters can be used to filter multicast
groups (l2 no l3)
Luca
On Mar 26, 2011, at 7:15 PM, Yann Jouanin wrote:
I would like to use the IP/port filtering (basically to filter multicast udp
flow).
Yann
2011/3/26 Luca Deri d...@ntop.org
Yann,
so
Nicolas
please resync with SVN: I think I have fixed (my fault I left some code
half-way while restructuring PF_RING)
Luca
On Mar 26, 2011, at 5:32 AM, Nicholas Gaugler wrote:
Luca,
1.) I am using the igb-2.4.12 driver provided in the SVN.
2.) I have seen this problem with every
Yann,
so far I support Intel 82599, and soon
- http://www.silicom-usa.com/default.asp?contentID=2097
- http://www.silicom-usa.com/default.asp?contentID=1019
Intel filtering is kind of limited, whereas Silicom filtering is very advanced
and flexible. What kind of filtering rules do you need?
David
you cannot do that as RSS is not bi-directional
Luca
On Mar 25, 2011, at 9:14 AM, David Kwan wrote:
Hi all,
In my understanding, RSS of intel 82599 is not bi-directional, i.e ...This
means that A-B packets go to queue X, and B-A go to queue Y, where X != Y.
by Luca at a reply on a
Nicholas
1. what driver are you using?
2. if this a problem of pfcount_multichannel or pfcount ?
Luca
On Mar 25, 2011, at 1:31 AM, Nicholas Gaugler wrote:
I am currently experiencing high CPU usage as well. I have a brand new box;
with Debian 6, PF_RING Version 4.6.3 ($Revision: 4539$), and
Yann
how did you test it, using pfcount? You're using the code in SVN ?
Luca
On Mar 18, 2011, at 3:41 PM, Yann Jouanin wrote:
Hello,
I just updated today from
PF_RING Version : 4.5.0 ($Revision: 4443M$)
to latest. Recompiled everything and now my capture process is using a
lot
Rui
it will not increase the numer of packets captured per PF_RING socket, but it
will allow you to create multiple threads/apps that will poll packet
concurrently and thus increase the overall performance. Please refer to this:
http://www.ntop.org/blog/?p=156
Luca
On Mar 17, 2011, at 3:58
Eugene
hw filters in 82599 do not allow MPLS filtering but there are other NICs that
can filter additional fields such as MPLS. If you tell me more about your
requirements (speed, filter type etc) I can see if I can help you
Regards Luca
On Mar 16, 2011, at 11:04 AM, b_eug...@ukr.net wrote:
Hi all,
let me explain this in detail.
A hash is a contiguous array of list pointers. Incoming flows are hashed (using
the 5 tuples) and the obtained hash_id value is used to identify the array
index. As hashes are a way to compress information, it might happen that two
different flows have
Fedor
I have just committed the patch you sent below.
Luca
On Feb 26, 2011, at 9:59 PM, Fedor Sakharov wrote:
Johan
unless you
1. send a complete log
2. allow me to compile on your box
I cannot help you
I guess install target in kernel makefile is a bit wrong, it has to
install
Reza
I don't know how came up with 500$. Just drop me a mail and explain me your
needs
Luca
On Feb 25, 2011, at 6:19 AM, reza a wrote:
Luca,
I would like to deploy nProbe to monitor VoIP calls, jitter, mos, bandwidth,
etc. Do you offer an unlimited license? We want to deploy this for all
Sylvain
a patch is on the way to you...
Luca
On Feb 22, 2011, at 6:26 PM, Sylvain Mouly wrote:
Ok Luca.
Bug created: https://www.ntop.org/bugzilla3/show_bug.cgi?id=38
Any idea about the difficulty to solve the issue ?
Thank you for your help
Sylvain
Le 22/02/11 17:37, Luca
Sylvain
please file a bug on https://www.ntop.org/bugzilla3/
Luca
On Feb 22, 2011, at 12:03 PM, Sylvain Mouly wrote:
Hello,
I'm using NProbe v6.1.6 as probe on a linux router and as a collector on a
server(which collect flows from several routers).
Everything works fine except the
Johan
IMHo there's something strange on your system as inside the makefile there's
EXTRA_CFLAGS += -I$(PWD)/..
thus you should compile it without any change
Luca
On Feb 18, 2011, at 1:36 PM, Johan Karlsson wrote:
Hey Luca,
The same error ;) dummy_plugin.c doesn't find the included file
Hi David
On Feb 16, 2011, at 10:18 AM, David Rodrigues wrote:
Hi all,
I'm trying PF_RING 4.6.0 (for Suricata and Snort) using a Intel(R)
82598EB 10 Gigabit Ethernet Controller
This controller seems to not support FlowDirector -
http://download.intel.com/design/network/prodbrf/317796.pdf
Praveen
please read http://www.ntop.org/blog/?p=280
Luca
On Feb 15, 2011, at 1:35 AM, Praveen Reguraman wrote:
Hi All,
I am trying to test my pf ring performance on a linux server with a
quadcore xeon and igb card. I installed pf_ring as suggested in the website
and also
threaded NAPI.
However, does this driver copy packets directly to PF_RING only on
mode=2? (http://www.ntop.org/blog/?p=280 - Thanks Luca for the post).
Thanks a lot,
David
On Mon, Feb 14, 2011 at 10:05 AM, Luca Deri d...@ntop.org wrote:
David
this is the link: http://www.ntop.org/blog/?p=280
, 2011 at 11:06 AM, Luca Deri d...@ntop.org wrote:
David
use the code in svn (I will cut SVN today so they we'll be in sync). This is
the only one I have
ixgbe-3.1.15-FlowDirector-NoTNAPI/
and in transparent_mode=2 it pushes packets to PF_RING
Luca
On Feb 14, 2011, at 10:41 AM
Luca
Cheers,
David
On Mon, Feb 14, 2011 at 1:02 PM, Luca Deri d...@ntop.org wrote:
On Feb 14, 2011, at 12:40 PM, David Rodrigues wrote:
Thanks Luca.
I will try this one. However the 2nd point remains.
Does this driver, on mode=2, copy packets directly to PF_RING only?
(http
install architecture-independent files in PREFIX
[/usr/local]
Cheers,
David
On Mon, Feb 14, 2011 at 4:53 PM, Luca Deri d...@ntop.org wrote:
On Feb 14, 2011, at 4:38 PM, David Rodrigues wrote:
Thanks Luca. I'm sorry to ask these questions. I have read all
the configure script.
After using ./configure --prefix=/opt/pfring/
If you have an empty /opt/pfring/ folder you still need to create
/opt/pfring/lib
/opt/pfring/include/
by hand.
It's not a big problem thou.
Thanks a lot,
David
On Mon, Feb 14, 2011 at 5:12 PM, Luca Deri d
.
--- En date de : Ven 11.2.11, Luca Deri d...@ntop.org a écrit :
De: Luca Deri d...@ntop.org
Objet: Re: [Ntop-misc] PF_RING on debian 6.0
À: ntop-misc@listgateway.unipi.it
Date: Vendredi 11 février 2011, 15h11
Thierry
can you please resync from SVN and see if it now works for you
manually copied
it into the kernel/plugins (it is dummy_plugin.c that complained about
missing header) and it compiled.
Cheers,
Thierry.
--- En date de : Ven 11.2.11, Luca Deri d...@ntop.org a écrit :
De: Luca Deri d...@ntop.org
Objet: Re: [Ntop-misc] PF_RING on debian 6.0
À: ntop-misc
Daniel,
I have no idea about this, but there isn't a limit if the number if reasonable.
Said this, I want to tell you that PF_RING was no optimized for a large number
of rings: this is on my todo list and I will work at it by this spring when I
have in mind to rework PF_RING quite a bit
Thanks Piotr: I have just committed it
Luca
On Feb 3, 2011, at 10:18 PM, Romanus, Piotr wrote:
I have recently tested sampling in pf_ring version 4.4.0. It seems to me that
this version contains a bug. When I set sampling rate to 2 the code in
add_skb_to_ring() samples every 3rd packet
Hi all
Thanks to all. The new driver release is in SVN
Luca
On 02/feb/2011, at 01:28, Chris Wakelin c.d.wake...@reading.ac.uk wrote:
I had a go at the igb driver when I did the e1000, but I haven't got an
igb card, so I couldn't test. I think you need to start with a newer
version than
entitled to an upgrade?
Thanks,
Piotr Romanus
Crossbeam Systems Inc
80 Central St
Boxborough, MA 01719
From: ntop-misc-boun...@listgateway.unipi.it
[ntop-misc-boun...@listgateway.unipi.it] on behalf of Luca Deri
[d...@ntop.org
David
it should. Please read http://luca.ntop.org/imc2010.pdf
Luca
On Jan 14, 2011, at 10:41 PM, David Rodrigues wrote:
Is there a lot of difference between transparent_mode=0 and 1 for a network
traffic of ~4Gbps?
On Fri, Jan 14, 2011 at 7:03 PM, Luca Deri d...@ntop.org wrote:
On Jan
Rui
if you use multiqueue, you have packet timestamp coherency only inside a
queue, but not across queues. This is the way hw works. Note that you can
bind PF_RING to multiple queues simultaneously or all at the same time.
Cheers Luca
On Fri, 28 Jan 2011 13:59:55 +0800, Rui wireles...@gmail.com
Simon
in the latest nProbe version we have made some changes, so that we avoid
loops caused by nProbe exporting flows with -n. Please update to the latest
nProbe.
Said that I would do
nprobe --collector-port 2055 -i none -n none -F 300 -P /tmp/flows
If you want to debug the issue, you can use
feedback) appears to be getting full flow, so the
configuration on the routers doesn't appear to be at fault.
Thanks for the response, I'll upgrade ASAP and keep trying.
On 27/01/11 21:47, Luca Deri wrote:
Simon
in the latest nProbe version we have made some changes, so that we avoid
Ben
I would appreciate if you could fill in a bug in
https://www.ntop.org/bugzilla3/ so I can track the issues you encountered and
fix them in the next release.
Thanks Luca
On Jan 27, 2011, at 9:12 PM, Ben WIlliams wrote:
Hi Simon,
I purchased the pro version of nprobe6 specifically for use
Piotr
thanks for the problem report. Can you please check if the PF_RING code,
currently in the SVN, works for you?
Regards Luca
On Jan 26, 2011, at 3:45 PM, Romanus, Piotr wrote:
This is just a warning that buffer_ring_handler() interface does not seem to
work. I tried using this interface
David
you can start with the standard driver, but if you use the PF_RING version of
the driver, you can use PF_RING in transparent_mode=1 or 2 that is faster.
Please make sure you compile snort on top of DAQ
(https://svn.ntop.org/svn/ntop/trunk/PF_RING/userland/snort/)
Luca
On Jan 14, 2011,
: 2.6.18-194.32.1 x86_64)
Thank you,
David
On Fri, Jan 14, 2011 at 4:14 PM, Luca Deri d...@ntop.org wrote:
David
you can start with the standard driver, but if you use the PF_RING version of
the driver, you can use PF_RING in transparent_mode=1 or 2 that is faster.
Please make sure you
at 6:18 PM, Luca Deri d...@ntop.org wrote:
David
multiqueue is supported on recent kernels. I doubt 2.6.18 can support that
Luca
On Jan 14, 2011, at 5:02 PM, David Rodrigues wrote:
Thanks Luca.
I would prefer to run PF_RING in transparent mode since I need it for a very
high speed
Rui
in my tests with 2 cores you can definitively capture at least 1 Gbit
(1.48 Mpps). How did you balance irq/threads/pfcount across cores? How
did you start pfcount?
Regards Luca
On 11/30/2010 08:28 AM, Rui wrote:
hi luca:
I have tuned some network parameters, such as irq affinity,
Rui
if you out the card in promiscuous move (e.g. via pfcount) you drop traffic as
traffic is not discarded by the NIC. Unless you have balance-able traffic (i.e.
if you send always the same packet it will definitively go onto the same queue)
all you observe is correct. Please read some of my
correctly.
Regards,
Martin
-Original Message-
From: ntop-misc-boun...@listgateway.unipi.it
[mailto:ntop-misc-boun...@listgateway.unipi.it] On Behalf Of Luca Deri
Sent: Donnerstag, 25. November 2010 19:29
To: ntop-misc@listgateway.unipi.it
Subject: Re: [Ntop-misc] nProbe
Martin
no license issues: there isn't such limitation in the code. 7k pps is nothing.
Is maybe your machine busy with other tasks? What is the overall system load?
What server/CPU do you use? Other packet capture apps such as wireshark or
tcpdump behave the same or you see no drops with them?
401 - 500 of 678 matches
Mail list logo
