I'll let Fred answer the memory leak issue, but since you're using the PF_PACKET send() method for sending packets, I can't think of any way it's tcpreplay's fault your NIC is going down. You've got a problem at a lower level (kernel, driver, hardware, switch, etc). You'll have to debug that yourself. :( -- Aaron Turner http://synfin.net/ Twitter: @synfinatic Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. -- Benjamin Franklin
On Wed, Jun 17, 2015 at 3:32 PM, Hashem Alaidaros <[email protected]> wrote: > Here is additional information: > Tcpreplay: > tcpreplay version: 4.1.0 (build git:v4.1.0) > Cache file supported: 04 > Not compiled with libdnet. > Compiled against libpcap: 1.1.1 > 64 bit packet counters: enabled > Packet editing: disabled > Fragroute engine: disabled > Injection method: PF_PACKET send() > Not compiled with netmap > > Pcap: > PCAP file: > http://www.isot.ece.uvic.ca/dataset/ISOT_Botnet_DataSet_2010.tar.gz > > NIC: > Ethernet controller: Intel Corporation Device 153a (rev 04) > Subsystem: Dell Device 05a4 > Kernel driver in use: e1000e > Kernel modules: e1000e > > I hope I get the answers of the two questions sent in the previous post. > > > On Wed, Jun 17, 2015 at 9:19 PM, Aaron Turner <[email protected]> wrote: >> >> First problem is probably a network driver or other hardware issue >> (possibly the switch itself). >> >> Second problem sounds like a memory leak. Maybe. Dunno, since you >> didn't say what version of tcpreplay you're using nobody can help you. >> >> Side note: mirror/SPAN ports often drop packets. >> >> -- >> Aaron Turner >> http://synfin.net/ Twitter: @synfinatic >> Those who would give up essential Liberty, to purchase a little temporary >> Safety, deserve neither Liberty nor Safety. >> -- Benjamin Franklin >> >> >> On Wed, Jun 17, 2015 at 11:12 AM, Hashem Alaidaros >> <[email protected]> wrote: >> > Hi, I'm Aid, >> > My tesbed: I run tcpreply on a PC1 (ubuntu 12.04 with Dell, i7 CPU, and >> > 32 >> > RAM, 1Gbps NIC) on eth0 which is connected to a Giga switch which >> > forward >> > the traffic (using port mirror) to another PC2 for traffic analysis. >> > Pcap size: 11 GB >> > >> > First, I run the following command >> > tcpreplay -i eth0 -M 100 data.pcap >> > Then after few seconds suddenly eth0 become down. I need to use ifdown >> > and >> > ifup then it works fine, then again down and so on. >> > 1) What is the cause? and How to solve this issue? >> > >> > Then I run the following command (just add -K) >> > tcpreplay -i eth0 -K -M 100 data.pcap >> > It works and eth0 is not hanging, but RAM (with 32 GB although the pcap >> > size >> > is 11 GB) suddenly filled from 5 MB to 32 GB full and system hang >> > (monitored >> > by htop). >> > 2) What is the cause? and How to solve this issue? >> > >> > I want to replay the pcap once only >> > >> > I hope someone answer the two questions above, thanks >> > >> > >> > >> > ------------------------------------------------------------------------------ >> > >> > _______________________________________________ >> > Tcpreplay-users mailing list >> > [email protected] >> > https://lists.sourceforge.net/lists/listinfo/tcpreplay-users >> > Support Information: http://tcpreplay.synfin.net/trac/wiki/Support >> >> >> ------------------------------------------------------------------------------ >> _______________________________________________ >> Tcpreplay-users mailing list >> [email protected] >> https://lists.sourceforge.net/lists/listinfo/tcpreplay-users >> Support Information: http://tcpreplay.synfin.net/trac/wiki/Support > > > > > -- > A friend in need Is a friend indeed > > ------------------------------------------------------------------------------ > > _______________________________________________ > Tcpreplay-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/tcpreplay-users > Support Information: http://tcpreplay.synfin.net/trac/wiki/Support ------------------------------------------------------------------------------ _______________________________________________ Tcpreplay-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/tcpreplay-users Support Information: http://tcpreplay.synfin.net/trac/wiki/Support
