First, thanks for the detailed information- it really helps! Anyways, inline...
On Fri, Jun 5, 2009 at 12:29 PM, Faustino Frechilla<frechi...@gmail.com> wrote: [snip] > This is the description: I play the pcap file through one network > interface. After some time playing (can't be sure of the actual time) > the network interface is gone for any other requests, that is, the > file is being played, but if I tried to access the server, ping, ssh > or whatever, I got no answers. All the ping packets I send are lost, > so I can't stop tcpreplay and it keeps on running until the file is > finished. An easy way to fix MY _problem_ would be to have an extra > network interface to access the machine while the other one is used to > pump the file, but still I would like to know if this behaviour is > expected or it is something strange that is happening because of the > way tcpreplay tries to simulate the real speed in which the file was > recorded. It's not expected or normal. > I'm sending the file through no routers. The two hosts are in the same > network. And I'm positive tcpplayer is sending the file because the > other end is reachable and it is receiving the data as expected. No > data is missing in the receiver. Interesting. I assume your tcpreplay box is connected to the other hosts via a switch? Do you know what kind? > This is the way I generated the files pcap: > > # I want all the traffic from the network 10. to be pumped into the > destination ip address > tcpprep --regex="10\..*" --pcap=orig.pcap --cachefile=cache.cache FYI, --cidr=10/8 is faster then --regex and does the same thing. > # 172.30.2.65 is the origin and 172.30.2.60 the destination > tcprewrite --endpoints=172.30.2.65:172.30.2.60 --cachefile=cache.cache > --infile=orig.pcap --outfile=temp.pcap --skipbroadcast > > # 00:00:00:00:00:AA and 00:00:00:00:00:BB are the destination and > source mac addresses > tcprewrite --enet-dmac=00:00:00:00:00:AA --enet-smac=00:00:00:00:00:BB > --cachefile=cache.cache --infile=temp.pcap --outfile=to_send.pcap FYI, you could combine the last two commands. :) > # and this is the offending command > sudo tcpreplay --intf1=eth0 --cachefile=cache.cache to_send.pcap Uh, that last command works? That's a bug. You should NOT be able to use a cachefile with a single interface. I can't say for certain that's the cause of your problem though. > I tried this very same commands using: > > tcpreplay version 3.3.1 under ubuntu desktop 8.10 in a 2Gb intel core > duo (2 usable processors) > tcpreplay version 3.0.1 under catapulta linux > (http://www.catapulta.org/). From their webpage, Catapulta is an > Ubuntu-based server platform that is designed and packaged > specifically for high-performance network monitoring applications > using commodity hardware. This is a server 32Gb RAM, intel 2 quad core > (2x4 processors) Both versions are a bit long in the tooth, but I'm not aware of any "fix" that would help. > In both cases the file was played at the expected speed (2.5 Mbits/s > aprox.) but after some time the network interface is not reachable (in > both cases) > > Then I compiled pcapplayer 3.4.2 (with pcap 0.9.5) in that catapulta > linux, and played the file. This time the network took more time to be > down and surprisingly tcpreplay is playing the file 10 times slower > than before, so the network is taking 10 times more to come back. The > file is a 10 minutes file so all this issue wasn't a big deal until > now, when I have to wait for 100 minutes instead of 10. Wow, that's really strange. I'd love to get a (compressed) copy of that pcap file- or maybe a few thousand packets worth at least. > Anyway, I got two questions: Is a normal behavior that the network > interface is gone while I play the file or there is something I'm not > doing fine when I try to play the file? why is tcpplayer 3.4.2 is > playing the file 10 times slower than 3.0.1 under the catapulta linux > box? I don't have a good answer for you to either of those questions. I'm grabbing the catapulta ISO right now to see can get an idea of what is going on. I know certain versions of glibc have been giving my timing code fits, but I thought all those issues were resolved. In the mean time, I'd suggest trying the different timing options and see what happens. Honestly, 2.5Mbps is basically nothing and there's something really strange if you're missing the mark that badly. Also, could you provide me the statistics output at the end of the run? Feel free to run the pcap for a minute and hit Ctrl-C- I don't need a full 10 or 100minute run. > About the hardware, all I can get now is that the ubuntu desktop 8.10 > network card is "00:19.0 Ethernet controller: Intel Corporation > 82567LM-3 Gigabit Network Connection" (I have no access to those > machines at the moment). If anyone needs more information about the > hardware I'll be back to you as soon as I can, but I hope some > questions can be answered roughly in the meantime, I'm dying here out > of curiosity!! I don't have any experience with that chipset, but I've never had these kind of problems with any Intel nic. Do you know what kernel version and if you're tweaking any of the NIC driver settings (usually in /etc/modules.conf). What Intel driver are you using? I think there is an e1000 (older) and e1000e (newer) with more recent kernels. -- Aaron Turner http://synfin.net/ http://tcpreplay.synfin.net/ - Pcap editing and replay tools for Unix & Windows Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. -- Benjamin Franklin ------------------------------------------------------------------------------ OpenSolaris 2009.06 is a cutting edge operating system for enterprises looking to deploy the next generation of Solaris that includes the latest innovations from Sun and the OpenSource community. Download a copy and enjoy capabilities such as Networking, Storage and Virtualization. Go to: http://p.sf.net/sfu/opensolaris-get _______________________________________________ Tcpreplay-users mailing list Tcpreplay-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/tcpreplay-users Support Information: http://tcpreplay.synfin.net/trac/wiki/Support
