Marco, > On 6 Feb 2019, at 13:16, Marco Pirovano <marco.pirov...@unibocconi.it> wrote: > > Hi Simone, > > I've configured ntopng to start with the 4 zc:ens2@[0-3], but I see lot of > dropped Packets, over 90%: > > Received Traffic 20.14 GB [48,789,336 Pkts] Dropped Packets > 515,138,975 Pkts [ 91.35 % ]
Are you getting drops for any of the 4 interfaces configured? How many PPS each interface is getting, on average? Did you try with core pinning as suggested? Please, post the full configuration used. > > Also, the speed of the 4 zc:ens2 interfaces is 10 Gbit/s, but the speed of > the view:zc:ens2 interfaces is 1 Gbit/s > > Marco > > ----- Il 4-feb-19, alle 17:19, Simone Mainardi maina...@ntop.org ha scritto: > >> Hi Marco, >> >> As you're using RSS with 4 queues, you are balancing the incoming traffic >> among >> 4 queues. >> >> In order to monitor every single queue in ntopng, you have to explicitly >> tell it >> to monitor these 4 queues. >> >> So you should do >> >> -i="zc:ens2@0" >> -i="zc:ens2@1" >> -i="zc:ens2@2" >> -i="zc:ens2@3" >> >> Your current -i=ens2 is defaulting to queue number 0 and isn't using the Zero >> Copy driver. >> >> The use of zc: will reduce/eliminate the drops. Note that you can also play >> with >> core affinity (see --core-affinity) >> to make sure ntopng pins the 4 capturing threads spawned to certain cores >> that >> you want. >> >> Finally, if you want to merge the 4 interfaces in a single view, you can add >> an >> extra >> -i="view:zc:ens2@0,zc:ens2@1,zc:ens2@2,zc:ens2@3" >> >> Don't worry, the view won't put extra pressure on the machine. >> >> Regards, >> >> Simone >> >> >>> On 4 Feb 2019, at 12:29, Marco Pirovano <marco.pirov...@unibocconi.it> >>> wrote: >>> >>> Hello, >>> >>> we are using NTOPNG to monitor our 10G link to internet. >>> We are using an Arista switch in Tap Aggregation mode to send traffic to >>> NTOPNG >>> server. >>> >>> The traffic is about 2Gbps and we see several dropped packets: >>> >>> Received Traffic 157.47 GB [292,586,873 Pkts] Dropped Packets >>> 25,637,433 Pkts >>> [ 8.06 % ] >>> >>> I've configured PF_RING ZC, the interface is an Intel 82599, ixgbe driver. >>> >>> ixgbe.conf configuration: RSS=4,4,4,4 >>> >>> pf_fing.conf configuration: min_num_slots=65536 >>> >>> ntopng.conf configuratrion: >>> >>> # >>> -i=ens2 >>> # >>> -w=3000 >>> # >>> -m=10.0.0.0/8,193.205.23.0/24 >>> # >>> -n=1 >>> # >>> -d=/var/lib/ntopng >>> # >>> -x=150000 >>> # >>> -X=1000000 >>> # >>> >>> >>> What do I need to setup correctly to see less dropped packets ? >>> >>> Thank you very much. >>> Marco >>> >>> -- >>> Marco Pirovano >>> Security & Network Competence Centre >>> ICT - Universita' Bocconi >>> via Gobbi, 5 - 20136 Milano >>> Tel. +39 02 5836.3173 >>> _______________________________________________ >>> Ntop mailing list >>> Ntop@listgateway.unipi.it >>> http://listgateway.unipi.it/mailman/listinfo/ntop >> >> _______________________________________________ >> Ntop mailing list >> Ntop@listgateway.unipi.it >> http://listgateway.unipi.it/mailman/listinfo/ntop > > -- > Marco Pirovano > Security & Network Competence Centre > ICT - Universita' Bocconi > via Gobbi, 5 - 20136 Milano > Tel. +39 02 5836.3173 > _______________________________________________ > Ntop mailing list > Ntop@listgateway.unipi.it > http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list Ntop@listgateway.unipi.it http://listgateway.unipi.it/mailman/listinfo/ntop
