Hi Marco could you provide a couple more lines from the pfcount stats to see the packets/bytes per second stats?
Thank you Alfredo > On 7 Feb 2019, at 14:35, Marco Pirovano <[email protected]> wrote: > > Hi Simone, > > these are the configurations used: > > /etc/ntopng/ntopng.conf > > # > -i="zc:ens2@0" > -i="zc:ens2@1" > -i="zc:ens2@2" > -i="zc:ens2@3" > -i="view:zc:ens2@0,zc:ens2@1,zc:ens2@3,zc:ens2@3" > # > -w=3000 > # > -m=10.0.0.0/8,193.205.23.0/24 > # > -n=1 > # > -d=/var/lib/ntopng > # > -x=150000 > # > -X=1000000 > # > #--capture-direction 1 > # > > > /etc/pf_ring/ > > pf_ring.conf > min_num_slots=65536 > > hugepages.conf > node=0 hugepagenumber=1024 > > interfaces.conf > MANAGEMENT_INTERFACES="enp2s0f0" > CAPTURE_INTERFACES="ens2" > > zc/ixgbe/ixgbe.conf > RSS=4,4,4,4 > > > cat /proc/net/pf_ring/dev/ens2/info > > Name: ens2 > Index: 8 > Address: 90:E2:BA:E0:62:04 > Polling Mode: NAPI/ZC > Type: Ethernet > Family: Intel ixgbe 82599 > TX Queues: 4 > RX Queues: 4 > Num RX Slots: 32768 > Num TX Slots: 32768 > > > [root@ntopng ~]# pf_ringctl status > Drivers Loaded > pf_ring Loaded > > > root@ntopng ~]# pfcount -i zc:ens2@0 > Using PF_RING v.7.4.0 > Capturing from zc:ens2@0 [mac: 90:E2:BA:E0:62:04][if_index: 8][speed: > 10000Mb/s] > # Device RX channels: 4 > # Polling threads: 1 > Dumping statistics on /proc/net/pf_ring/stats/26507-ens2.100 > ========================= > Absolute Stats: [56'087 pkts total][0 pkts dropped][0.0% dropped] > [56'087 pkts rcvd][34'330'999 bytes rcvd] > ========================= > > [root@ntopng ~]# pfcount -i zc:ens2@1 > Using PF_RING v.7.4.0 > Capturing from zc:ens2@1 [mac: 90:E2:BA:E0:62:04][if_index: 8][speed: > 10000Mb/s] > # Device RX channels: 4 > # Polling threads: 1 > Dumping statistics on /proc/net/pf_ring/stats/26519-ens2.101 > ========================= > Absolute Stats: [31'149 pkts total][0 pkts dropped][0.0% dropped] > [31'149 pkts rcvd][13'806'852 bytes rcvd] > ========================= > > [root@ntopng ~]# > [root@ntopng ~]# pfcount -i zc:ens2@2 > Using PF_RING v.7.4.0 > Capturing from zc:ens2@2 [mac: 90:E2:BA:E0:62:04][if_index: 8][speed: > 10000Mb/s] > # Device RX channels: 4 > # Polling threads: 1 > Dumping statistics on /proc/net/pf_ring/stats/26530-ens2.102 > ========================= > Absolute Stats: [26'905 pkts total][0 pkts dropped][0.0% dropped] > [26'905 pkts rcvd][14'088'572 bytes rcvd] > ========================= > > [root@ntopng ~]# > [root@ntopng ~]# pfcount -i zc:ens2@3 > Using PF_RING v.7.4.0 > Capturing from zc:ens2@3 [mac: 90:E2:BA:E0:62:04][if_index: 8][speed: > 10000Mb/s] > # Device RX channels: 4 > # Polling threads: 1 > Dumping statistics on /proc/net/pf_ring/stats/26531-ens2.103 > ========================= > Absolute Stats: [26'484 pkts total][0 pkts dropped][0.0% dropped] > [26'484 pkts rcvd][16'016'959 bytes rcvd] > ========================= > > As you can see, from the CLI, there are no packets dropped, > but from the NTOPNG GUI I see, for the view:zc... interface: > > Received Traffic 854.75 GB [1,669,799,657 Pkts] Dropped Packets > 1,444,351,763 Pkts [ 46.38 % ] > > Whats wring ? > > Thanks a lot. > Marco > > ----- Il 7-feb-19, alle 9:15, Simone Mainardi [email protected] ha scritto: > >> Marco, >> >>> On 6 Feb 2019, at 13:16, Marco Pirovano <[email protected]> >>> wrote: >>> >>> Hi Simone, >>> >>> I've configured ntopng to start with the 4 zc:ens2@[0-3], but I see lot of >>> dropped Packets, over 90%: >>> >>> Received Traffic 20.14 GB [48,789,336 Pkts] Dropped Packets >>> 515,138,975 Pkts >>> [ 91.35 % ] >> >> Are you getting drops for any of the 4 interfaces configured? How many PPS >> each >> interface is getting, on average? Did you try with core pinning as suggested? >> >> Please, post the full configuration used. >> >>> >>> Also, the speed of the 4 zc:ens2 interfaces is 10 Gbit/s, but the speed of >>> the >>> view:zc:ens2 interfaces is 1 Gbit/s >>> >>> Marco >>> >>> ----- Il 4-feb-19, alle 17:19, Simone Mainardi [email protected] ha scritto: >>> >>>> Hi Marco, >>>> >>>> As you're using RSS with 4 queues, you are balancing the incoming traffic >>>> among >>>> 4 queues. >>>> >>>> In order to monitor every single queue in ntopng, you have to explicitly >>>> tell it >>>> to monitor these 4 queues. >>>> >>>> So you should do >>>> >>>> -i="zc:ens2@0" >>>> -i="zc:ens2@1" >>>> -i="zc:ens2@2" >>>> -i="zc:ens2@3" >>>> >>>> Your current -i=ens2 is defaulting to queue number 0 and isn't using the >>>> Zero >>>> Copy driver. >>>> >>>> The use of zc: will reduce/eliminate the drops. Note that you can also >>>> play with >>>> core affinity (see --core-affinity) >>>> to make sure ntopng pins the 4 capturing threads spawned to certain cores >>>> that >>>> you want. >>>> >>>> Finally, if you want to merge the 4 interfaces in a single view, you can >>>> add an >>>> extra >>>> -i="view:zc:ens2@0,zc:ens2@1,zc:ens2@2,zc:ens2@3" >>>> >>>> Don't worry, the view won't put extra pressure on the machine. >>>> >>>> Regards, >>>> >>>> Simone >>>> >>>> >>>>> On 4 Feb 2019, at 12:29, Marco Pirovano <[email protected]> >>>>> wrote: >>>>> >>>>> Hello, >>>>> >>>>> we are using NTOPNG to monitor our 10G link to internet. >>>>> We are using an Arista switch in Tap Aggregation mode to send traffic to >>>>> NTOPNG >>>>> server. >>>>> >>>>> The traffic is about 2Gbps and we see several dropped packets: >>>>> >>>>> Received Traffic 157.47 GB [292,586,873 Pkts] Dropped Packets >>>>> 25,637,433 Pkts >>>>> [ 8.06 % ] >>>>> >>>>> I've configured PF_RING ZC, the interface is an Intel 82599, ixgbe driver. >>>>> >>>>> ixgbe.conf configuration: RSS=4,4,4,4 >>>>> >>>>> pf_fing.conf configuration: min_num_slots=65536 >>>>> >>>>> ntopng.conf configuratrion: >>>>> >>>>> # >>>>> -i=ens2 >>>>> # >>>>> -w=3000 >>>>> # >>>>> -m=10.0.0.0/8,193.205.23.0/24 >>>>> # >>>>> -n=1 >>>>> # >>>>> -d=/var/lib/ntopng >>>>> # >>>>> -x=150000 >>>>> # >>>>> -X=1000000 >>>>> # >>>>> >>>>> >>>>> What do I need to setup correctly to see less dropped packets ? >>>>> >>>>> Thank you very much. >>>>> Marco >>>>> >>>>> -- >>>>> Marco Pirovano >>>>> Security & Network Competence Centre >>>>> ICT - Universita' Bocconi >>>>> via Gobbi, 5 - 20136 Milano >>>>> Tel. +39 02 5836.3173 >>>>> _______________________________________________ >>>>> Ntop mailing list >>>>> [email protected] >>>>> http://listgateway.unipi.it/mailman/listinfo/ntop >>>> >>>> _______________________________________________ >>>> Ntop mailing list >>>> [email protected] >>>> http://listgateway.unipi.it/mailman/listinfo/ntop >>> >>> -- >>> Marco Pirovano >>> Security & Network Competence Centre >>> ICT - Universita' Bocconi >>> via Gobbi, 5 - 20136 Milano >>> Tel. +39 02 5836.3173 >>> _______________________________________________ >>> Ntop mailing list >>> [email protected] >>> http://listgateway.unipi.it/mailman/listinfo/ntop >> >> _______________________________________________ >> Ntop mailing list >> [email protected] >> http://listgateway.unipi.it/mailman/listinfo/ntop > > -- > Marco Pirovano > Security & Network Competence Centre > ICT - Universita' Bocconi > via Gobbi, 5 - 20136 Milano > Tel. +39 02 5836.3173 > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
