Hello Everyone, My nprobe is dropping packets. I am parsing GTPv1 and GTPv2 traffic and it is dropping packets.
Packet Drops: Duration: 0:00:03:14:028 Bytes: 716492747 Packets: 1578377 Dropped: 757155 Duration: 0:00:03:16:029 Bytes: 721327235 Packets: 1589106 Dropped: 787448 Duration: 0:00:03:17:029 Bytes: 724705319 Packets: 1596837 Dropped: 802482 Duration: 0:00:04:32:040 Bytes: 895463735 Packets: 1973912 Dropped: 1988866 Verbose Logging: Sep 18 01:45:14 gtp-parser nprobe[2011]: 18/Sep/2019 01:45:14 [nprobe.c:3330] Average traffic: [4.16 K pps][All Traffic 14.68 Mb/sec][IP Traffic 12.35 Mb/sec][ratio 0.85] Sep 18 01:45:14 gtp-parser nprobe[2011]: 18/Sep/2019 01:45:14 [nprobe.c:3338] Current traffic: [4.18 K pps][14.69 Mb/sec] Sep 18 11:57:42 gtp-parser nprobe[2100]: 18/Sep/2019 11:57:42 [nprobe.c:3330] Average traffic: [5.41 K pps][All Traffic 17.59 Mb/sec][IP Traffic 14.54 Mb/sec][ratio 0.83] Sep 18 11:57:42 gtp-parser nprobe[2100]: 18/Sep/2019 11:57:42 [nprobe.c:3338] Current traffic: [5.49 K pps][17.85 Mb/sec] My nprobe configuration file: -g=/var/run/nprobe.pid -G= -i=anic:0 -n=none -T=%FIRST_SWITCHED \ %LAST_SWITCHED \ %FLOW_START_MILLISECONDS \ %FLOW_END_MILLISECONDS \ %IN_PKTS \ %IN_BYTES \ %IPV4_SRC_ADDR \ %IPV4_DST_ADDR \ %INPUT_SNMP \ %OUTPUT_SNMP \ %L4_SRC_PORT \ %L4_DST_PORT \ %TCP_FLAGS \ %PROTOCOL \ %SRC_TOS \ %BIFLOW_DIRECTION \ %L7_PROTO \ %APPLICATION_ID \ %UPSTREAM_TUNNEL_ID \ %DOWNSTREAM_TUNNEL_ID \ %UNTUNNELED_IPV4_SRC_ADDR \ %UNTUNNELED_IPV4_DST_ADDR \ %UNTUNNELED_PROTOCOL \ %GTPV1_REQ_MSG_TYPE \ %GTPV1_RSP_MSG_TYPE \ %GTPV1_C2S_TEID_DATA \ %GTPV1_C2S_TEID_CTRL \ %GTPV1_S2C_TEID_DATA \ %GTPV1_S2C_TEID_CTRL \ %GTPV1_END_USER_IP \ %GTPV1_END_USER_IMSI \ %GTPV1_END_USER_MSISDN \ %GTPV1_END_USER_IMEI \ %GTPV1_APN_NAME \ %GTPV1_RAI_MCC \ %GTPV1_RAI_MNC \ %GTPV1_RAI_LAC \ %GTPV1_RAI_RAC \ %GTPV1_ULI_MCC \ %GTPV1_ULI_MNC \ %GTPV1_ULI_CELL_LAC \ %GTPV1_ULI_CELL_CI \ %GTPV1_ULI_SAC \ %GTPV1_RESPONSE_CAUSE \ %GTPV1_RAT_TYPE \ %GTPV2_REQ_MSG_TYPE \ %GTPV2_RSP_MSG_TYPE \ %GTPV2_S5_S8_GTPC_TEID \ %GTPV2_C2S_S5_S8_GTPU_TEID \ %GTPV2_S2C_S5_S8_GTPU_TEID \ %GTPV2_C2S_S5_S8_GTPU_IP \ %GTPV2_S2C_S5_S8_GTPU_IP \ %GTPV2_END_USER_IMSI \ %GTPV2_END_USER_MSISDN \ %GTPV2_APN_NAME \ %GTPV2_ULI_MCC \ %GTPV2_ULI_MNC \ %GTPV2_ULI_CELL_TAC \ %GTPV2_ULI_CELL_ID \ %GTPV2_RESPONSE_CAUSE \ %GTPV2_RAT_TYPE \ %GTPV2_PDN_IP \ %GTPV2_END_USER_IMEI --cpu-affinity=1,2,3,4,5 --export-thread-affinity=5 --biflows-export-policy=0 --tcp=192.168.115.205:5510 --drop-flow-no-plugin --capture-direction=1 --tunnel --max-num-untunnels --account-imsi-traffic nProbe version: v.8.6.190909 (r6339) OS: Debian GNU/Linux 9 (stretch) Hardware Settings: Intel(R) Xeon(R) Bronze 3104 CPU @ 1.70GHz Architecture: x86_64 CPU(s): 6 MemTotal: 23268540 kB MemFree: 20080372 kB MemAvailable: 19934104 kB Buffers: 26204 kB Cached: 76816 kB total used free shared buff/cache available Mem: 22G 2.9G 19G 8.9M 140M 19G Swap: 93G 0B 93G NIC Cards: ANIC-40KU (Accolade) Same issue with Intel NIC card: ethtool -i enp23s0f1 driver: i40e version: 1.6.16-k firmware-version: 6.01 0x800036de 1.1861.0 expansion-rom-version: bus-info: 0000:17:00.1 supports-statistics: yes supports-test: yes supports-eeprom-access: yes supports-register-dump: yes supports-priv-flags: yes Thanks and Regards, -=Srijan Nandi
_______________________________________________ Ntop mailing list Ntop@listgateway.unipi.it http://listgateway.unipi.it/mailman/listinfo/ntop
