Hi Simone, these are the configurations used:
/etc/ntopng/ntopng.conf # -i="zc:ens2@0" -i="zc:ens2@1" -i="zc:ens2@2" -i="zc:ens2@3" -i="view:zc:ens2@0,zc:ens2@1,zc:ens2@3,zc:ens2@3" # -w=3000 # -m=10.0.0.0/8,193.205.23.0/24 # -n=1 # -d=/var/lib/ntopng # -x=150000 # -X=1000000 # #--capture-direction 1 # /etc/pf_ring/ pf_ring.conf min_num_slots=65536 hugepages.conf node=0 hugepagenumber=1024 interfaces.conf MANAGEMENT_INTERFACES="enp2s0f0" CAPTURE_INTERFACES="ens2" zc/ixgbe/ixgbe.conf RSS=4,4,4,4 cat /proc/net/pf_ring/dev/ens2/info Name: ens2 Index: 8 Address: 90:E2:BA:E0:62:04 Polling Mode: NAPI/ZC Type: Ethernet Family: Intel ixgbe 82599 TX Queues: 4 RX Queues: 4 Num RX Slots: 32768 Num TX Slots: 32768 [root@ntopng ~]# pf_ringctl status Drivers Loaded pf_ring Loaded root@ntopng ~]# pfcount -i zc:ens2@0 Using PF_RING v.7.4.0 Capturing from zc:ens2@0 [mac: 90:E2:BA:E0:62:04][if_index: 8][speed: 10000Mb/s] # Device RX channels: 4 # Polling threads: 1 Dumping statistics on /proc/net/pf_ring/stats/26507-ens2.100 ========================= Absolute Stats: [56'087 pkts total][0 pkts dropped][0.0% dropped] [56'087 pkts rcvd][34'330'999 bytes rcvd] ========================= [root@ntopng ~]# pfcount -i zc:ens2@1 Using PF_RING v.7.4.0 Capturing from zc:ens2@1 [mac: 90:E2:BA:E0:62:04][if_index: 8][speed: 10000Mb/s] # Device RX channels: 4 # Polling threads: 1 Dumping statistics on /proc/net/pf_ring/stats/26519-ens2.101 ========================= Absolute Stats: [31'149 pkts total][0 pkts dropped][0.0% dropped] [31'149 pkts rcvd][13'806'852 bytes rcvd] ========================= [root@ntopng ~]# [root@ntopng ~]# pfcount -i zc:ens2@2 Using PF_RING v.7.4.0 Capturing from zc:ens2@2 [mac: 90:E2:BA:E0:62:04][if_index: 8][speed: 10000Mb/s] # Device RX channels: 4 # Polling threads: 1 Dumping statistics on /proc/net/pf_ring/stats/26530-ens2.102 ========================= Absolute Stats: [26'905 pkts total][0 pkts dropped][0.0% dropped] [26'905 pkts rcvd][14'088'572 bytes rcvd] ========================= [root@ntopng ~]# [root@ntopng ~]# pfcount -i zc:ens2@3 Using PF_RING v.7.4.0 Capturing from zc:ens2@3 [mac: 90:E2:BA:E0:62:04][if_index: 8][speed: 10000Mb/s] # Device RX channels: 4 # Polling threads: 1 Dumping statistics on /proc/net/pf_ring/stats/26531-ens2.103 ========================= Absolute Stats: [26'484 pkts total][0 pkts dropped][0.0% dropped] [26'484 pkts rcvd][16'016'959 bytes rcvd] ========================= As you can see, from the CLI, there are no packets dropped, but from the NTOPNG GUI I see, for the view:zc... interface: Received Traffic 854.75 GB [1,669,799,657 Pkts] Dropped Packets 1,444,351,763 Pkts [ 46.38 % ] Whats wring ? Thanks a lot. Marco ----- Il 7-feb-19, alle 9:15, Simone Mainardi maina...@ntop.org ha scritto: > Marco, > >> On 6 Feb 2019, at 13:16, Marco Pirovano <marco.pirov...@unibocconi.it> wrote: >> >> Hi Simone, >> >> I've configured ntopng to start with the 4 zc:ens2@[0-3], but I see lot of >> dropped Packets, over 90%: >> >> Received Traffic 20.14 GB [48,789,336 Pkts] Dropped Packets >> 515,138,975 Pkts >> [ 91.35 % ] > > Are you getting drops for any of the 4 interfaces configured? How many PPS > each > interface is getting, on average? Did you try with core pinning as suggested? > > Please, post the full configuration used. > >> >> Also, the speed of the 4 zc:ens2 interfaces is 10 Gbit/s, but the speed of >> the >> view:zc:ens2 interfaces is 1 Gbit/s >> >> Marco >> >> ----- Il 4-feb-19, alle 17:19, Simone Mainardi maina...@ntop.org ha scritto: >> >>> Hi Marco, >>> >>> As you're using RSS with 4 queues, you are balancing the incoming traffic >>> among >>> 4 queues. >>> >>> In order to monitor every single queue in ntopng, you have to explicitly >>> tell it >>> to monitor these 4 queues. >>> >>> So you should do >>> >>> -i="zc:ens2@0" >>> -i="zc:ens2@1" >>> -i="zc:ens2@2" >>> -i="zc:ens2@3" >>> >>> Your current -i=ens2 is defaulting to queue number 0 and isn't using the >>> Zero >>> Copy driver. >>> >>> The use of zc: will reduce/eliminate the drops. Note that you can also play >>> with >>> core affinity (see --core-affinity) >>> to make sure ntopng pins the 4 capturing threads spawned to certain cores >>> that >>> you want. >>> >>> Finally, if you want to merge the 4 interfaces in a single view, you can >>> add an >>> extra >>> -i="view:zc:ens2@0,zc:ens2@1,zc:ens2@2,zc:ens2@3" >>> >>> Don't worry, the view won't put extra pressure on the machine. >>> >>> Regards, >>> >>> Simone >>> >>> >>>> On 4 Feb 2019, at 12:29, Marco Pirovano <marco.pirov...@unibocconi.it> >>>> wrote: >>>> >>>> Hello, >>>> >>>> we are using NTOPNG to monitor our 10G link to internet. >>>> We are using an Arista switch in Tap Aggregation mode to send traffic to >>>> NTOPNG >>>> server. >>>> >>>> The traffic is about 2Gbps and we see several dropped packets: >>>> >>>> Received Traffic 157.47 GB [292,586,873 Pkts] Dropped Packets >>>> 25,637,433 Pkts >>>> [ 8.06 % ] >>>> >>>> I've configured PF_RING ZC, the interface is an Intel 82599, ixgbe driver. >>>> >>>> ixgbe.conf configuration: RSS=4,4,4,4 >>>> >>>> pf_fing.conf configuration: min_num_slots=65536 >>>> >>>> ntopng.conf configuratrion: >>>> >>>> # >>>> -i=ens2 >>>> # >>>> -w=3000 >>>> # >>>> -m=10.0.0.0/8,193.205.23.0/24 >>>> # >>>> -n=1 >>>> # >>>> -d=/var/lib/ntopng >>>> # >>>> -x=150000 >>>> # >>>> -X=1000000 >>>> # >>>> >>>> >>>> What do I need to setup correctly to see less dropped packets ? >>>> >>>> Thank you very much. >>>> Marco >>>> >>>> -- >>>> Marco Pirovano >>>> Security & Network Competence Centre >>>> ICT - Universita' Bocconi >>>> via Gobbi, 5 - 20136 Milano >>>> Tel. +39 02 5836.3173 >>>> _______________________________________________ >>>> Ntop mailing list >>>> Ntop@listgateway.unipi.it >>>> http://listgateway.unipi.it/mailman/listinfo/ntop >>> >>> _______________________________________________ >>> Ntop mailing list >>> Ntop@listgateway.unipi.it >>> http://listgateway.unipi.it/mailman/listinfo/ntop >> >> -- >> Marco Pirovano >> Security & Network Competence Centre >> ICT - Universita' Bocconi >> via Gobbi, 5 - 20136 Milano >> Tel. +39 02 5836.3173 >> _______________________________________________ >> Ntop mailing list >> Ntop@listgateway.unipi.it >> http://listgateway.unipi.it/mailman/listinfo/ntop > > _______________________________________________ > Ntop mailing list > Ntop@listgateway.unipi.it > http://listgateway.unipi.it/mailman/listinfo/ntop -- Marco Pirovano Security & Network Competence Centre ICT - Universita' Bocconi via Gobbi, 5 - 20136 Milano Tel. +39 02 5836.3173 _______________________________________________ Ntop mailing list Ntop@listgateway.unipi.it http://listgateway.unipi.it/mailman/listinfo/ntop
