Yes, I agree with Aaron. It is difficult to imagine tcpreplay being the cause of the memory leak when using PF_PACKET.
How are you seeing the memory leak? Are you using “top”? If so, can you send me a screen capture that includes the offending process? Also, please have a look at either syslog or the kernel log for any trace info. I am specifically looking for OOM (out-of-memory) logs. Finally, please send me the output of the ‘lsmod’ and the ‘uname -a’ commands. Thanks, Fred. > On Jun 17, 2015, at 3:54 PM, Aaron Turner <synfina...@gmail.com> wrote: > > I'll let Fred answer the memory leak issue, but since you're using the > PF_PACKET send() method for sending packets, I can't think of any way > it's tcpreplay's fault your NIC is going down. You've got a problem > at a lower level (kernel, driver, hardware, switch, etc). You'll have > to debug that yourself. :( > -- > Aaron Turner > http://synfin.net/ Twitter: @synfinatic > Those who would give up essential Liberty, to purchase a little temporary > Safety, deserve neither Liberty nor Safety. > -- Benjamin Franklin > > > On Wed, Jun 17, 2015 at 3:32 PM, Hashem Alaidaros <aidaros....@gmail.com> > wrote: >> Here is additional information: >> Tcpreplay: >> tcpreplay version: 4.1.0 (build git:v4.1.0) >> Cache file supported: 04 >> Not compiled with libdnet. >> Compiled against libpcap: 1.1.1 >> 64 bit packet counters: enabled >> Packet editing: disabled >> Fragroute engine: disabled >> Injection method: PF_PACKET send() >> Not compiled with netmap >> >> Pcap: >> PCAP file: >> http://www.isot.ece.uvic.ca/dataset/ISOT_Botnet_DataSet_2010.tar.gz >> >> NIC: >> Ethernet controller: Intel Corporation Device 153a (rev 04) >> Subsystem: Dell Device 05a4 >> Kernel driver in use: e1000e >> Kernel modules: e1000e >> >> I hope I get the answers of the two questions sent in the previous post. >> >> >> On Wed, Jun 17, 2015 at 9:19 PM, Aaron Turner <synfina...@gmail.com> wrote: >>> >>> First problem is probably a network driver or other hardware issue >>> (possibly the switch itself). >>> >>> Second problem sounds like a memory leak. Maybe. Dunno, since you >>> didn't say what version of tcpreplay you're using nobody can help you. >>> >>> Side note: mirror/SPAN ports often drop packets. >>> >>> -- >>> Aaron Turner >>> http://synfin.net/ Twitter: @synfinatic >>> Those who would give up essential Liberty, to purchase a little temporary >>> Safety, deserve neither Liberty nor Safety. >>> -- Benjamin Franklin >>> >>> >>> On Wed, Jun 17, 2015 at 11:12 AM, Hashem Alaidaros >>> <aidaros....@gmail.com> wrote: >>>> Hi, I'm Aid, >>>> My tesbed: I run tcpreply on a PC1 (ubuntu 12.04 with Dell, i7 CPU, and >>>> 32 >>>> RAM, 1Gbps NIC) on eth0 which is connected to a Giga switch which >>>> forward >>>> the traffic (using port mirror) to another PC2 for traffic analysis. >>>> Pcap size: 11 GB >>>> >>>> First, I run the following command >>>> tcpreplay -i eth0 -M 100 data.pcap >>>> Then after few seconds suddenly eth0 become down. I need to use ifdown >>>> and >>>> ifup then it works fine, then again down and so on. >>>> 1) What is the cause? and How to solve this issue? >>>> >>>> Then I run the following command (just add -K) >>>> tcpreplay -i eth0 -K -M 100 data.pcap >>>> It works and eth0 is not hanging, but RAM (with 32 GB although the pcap >>>> size >>>> is 11 GB) suddenly filled from 5 MB to 32 GB full and system hang >>>> (monitored >>>> by htop). >>>> 2) What is the cause? and How to solve this issue? >>>> >>>> I want to replay the pcap once only >>>> >>>> I hope someone answer the two questions above, thanks >>>> >>>> >>>> >>>> ------------------------------------------------------------------------------ >>>> >>>> _______________________________________________ >>>> Tcpreplay-users mailing list >>>> Tcpreplay-users@lists.sourceforge.net >>>> https://lists.sourceforge.net/lists/listinfo/tcpreplay-users >>>> Support Information: http://tcpreplay.synfin.net/trac/wiki/Support >>> >>> >>> ------------------------------------------------------------------------------ >>> _______________________________________________ >>> Tcpreplay-users mailing list >>> Tcpreplay-users@lists.sourceforge.net >>> https://lists.sourceforge.net/lists/listinfo/tcpreplay-users >>> Support Information: http://tcpreplay.synfin.net/trac/wiki/Support >> >> >> >> >> -- >> A friend in need Is a friend indeed >> >> ------------------------------------------------------------------------------ >> >> _______________________________________________ >> Tcpreplay-users mailing list >> Tcpreplay-users@lists.sourceforge.net >> https://lists.sourceforge.net/lists/listinfo/tcpreplay-users >> Support Information: http://tcpreplay.synfin.net/trac/wiki/Support > > ------------------------------------------------------------------------------ > _______________________________________________ > Tcpreplay-users mailing list > Tcpreplay-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/tcpreplay-users > Support Information: http://tcpreplay.synfin.net/trac/wiki/Support ------------------------------------------------------------------------------ _______________________________________________ Tcpreplay-users mailing list Tcpreplay-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/tcpreplay-users Support Information: http://tcpreplay.synfin.net/trac/wiki/Support
