Mailing List Archive

Jeremy,
I annoy sure I understand. in essence you have attached cento to zbalance_ipc queues, and the traffic rates are not correct? What you see with pfcount instead?

This said, what do you want to do exactly? Perhaps use cento as flow-generator and attach bro to it on balanced egress queues?

Regards luca

> On 3 Oct 2016, at 16:04, Jeremy Ashton <jeremy.ashton@shopify.com> wrote:
>
> After following these instructions:
> http://www.ntop.org/pf_ring/best-practices-for-using-bro_ids-with-pf_ring-zc-reliably/
>
> The actual command was like the following:
>
> zbalance_ipc -i zc:<link1>,zc:<link2>,zc:<link3>,zc:<link4> -n 4 -m 1
> -c 2 -r 0:dummy0 -r 1:dummy1 -r 2:dummy2 -r 3:dummy3
>
>
> I found it was reporting something like the following:
>
> 27/Sep/2016 18:17:56 [NetworkInterface.cpp:990] [dummy0] [8'854'686
> pps/19.83 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
> pkt drops][0 TX pps]
>
> 27/Sep/2016 18:17:56 [NetworkInterface.cpp:990] [dummy1] [18’428'232
> pps/41.28 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
> pkt drops][0 TX pps]
>
>
> If I configure cento to listen to the interfaces directly, I see that
> there is <5Gbit aggregate bandwidth. Is there something strange with
> the way cento attempts to listen to dummy interfaces?
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc

_______________________________________________
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc

Here is the deal. If I configure zbalance_ipc listen on 4x interfaces
and then map those queues to dummy interfaces; Cento shows the
bandwidth 100x more than reality. i.e. it shows 27.91Gbps whereas it
is actually ~279 Mbit/s.

pfcount on dummy0 interface:
$ sudo pfcount -i dummy0 -c 100

=========================
Absolute Stats: [152'733 pkts total][0 pkts dropped][0.0% dropped]
[152'733 pkts rcvd][108'744'822 bytes rcvd][50'907.23 pkt/sec][289.96 Mbit/sec]
=========================
Actual Stats: [41'132 pkts rcvd][1'000.05 ms][41'129.73 pps][0.25 Gbps]
=========================

=========================
Absolute Stats: [189'340 pkts total][0 pkts dropped][0.0% dropped]
[189'340 pkts rcvd][134'926'703 bytes rcvd][47'331.02 pkt/sec][269.83 Mbit/sec]
=========================
Actual Stats: [36'607 pkts rcvd][1'000.11 ms][36'602.82 pps][0.21 Gbps]
=========================


cento on dummy0 interface (should be 1/4 of total bandwidth):
$ sudo /usr/local/bin/zbalance_ipc -i
zc:<int1>,zc:<int2>,zc:<int3>,zc:<int4> -c10 -n4 -m1 -g0 -u
/mnt/hugepages/ -r 0:dummy0 -r 1:dummy1 -r 2:dummy2 -r 3:dummy3
$ sudo cento -i dummy0
03/Oct/2016 16:58:26 [NetworkInterface.cpp:990] [dummy0] [12'458'091
pps/27.91 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
pkt drops][0 TX pps]
03/Oct/2016 16:58:27 [NetworkInterface.cpp:990] [dummy0] [12'447'559
pps/27.88 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
pkt drops][0 TX pps]
03/Oct/2016 16:58:28 [NetworkInterface.cpp:990] [dummy0] [12'753'627
pps/28.57 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
pkt drops][0 TX pps]
03/Oct/2016 16:58:29 [NetworkInterface.cpp:990] [dummy0] [12'385'380
pps/27.74 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
pkt drops][0 TX pps]
03/Oct/2016 16:58:30 [NetworkInterface.cpp:990] [dummy0] [12’261'717
pps/27.47 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
pkt drops][0 TX pps]

cento on raw interface with zc:
$ sudo cento -i zc:<int1> -i zc:<int2> -i zc:<int3> -i zc:<int4> -g
1,2,3,4 -C 100 -H
03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int1>] [0
pps/0.00 Gbps][3’966/0/0/512’000 act/exp/drop/max flows][137’492/0
RX/TX pkt drops][0 TX pps]
03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int2>] [0
pps/0.00 Gbps][1’960/0/0/512’000 act/exp/drop/max flows][34’004/0
RX/TX pkt drops][0 TX pps]
03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int3>] [0
pps/0.00 Gbps][9’583/0/0/512’000 act/exp/drop/max flows][125’445/0
RX/TX pkt drops][0 TX pps]
03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int4>] [0
pps/0.00 Gbps][1/0/0/512’000 act/exp/drop/max flows][0/0 RX/TX put
drops][0 TX pps]

On Mon, Oct 3, 2016 at 10:14 AM, Luca Deri <deri@ntop.org> wrote:
> Jeremy,
> I annoy sure I understand. in essence you have attached cento to zbalance_ipc queues, and the traffic rates are not correct? What you see with pfcount instead?
>
> This said, what do you want to do exactly? Perhaps use cento as flow-generator and attach bro to it on balanced egress queues?
>
> Regards luca
>
>> On 3 Oct 2016, at 16:04, Jeremy Ashton <jeremy.ashton@shopify.com> wrote:
>>
>> After following these instructions:
>> http://www.ntop.org/pf_ring/best-practices-for-using-bro_ids-with-pf_ring-zc-reliably/
>>
>> The actual command was like the following:
>>
>> zbalance_ipc -i zc:<link1>,zc:<link2>,zc:<link3>,zc:<link4> -n 4 -m 1
>> -c 2 -r 0:dummy0 -r 1:dummy1 -r 2:dummy2 -r 3:dummy3
>>
>>
>> I found it was reporting something like the following:
>>
>> 27/Sep/2016 18:17:56 [NetworkInterface.cpp:990] [dummy0] [8'854'686
>> pps/19.83 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
>> pkt drops][0 TX pps]
>>
>> 27/Sep/2016 18:17:56 [NetworkInterface.cpp:990] [dummy1] [18’428'232
>> pps/41.28 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
>> pkt drops][0 TX pps]
>>
>>
>> If I configure cento to listen to the interfaces directly, I see that
>> there is <5Gbit aggregate bandwidth. Is there something strange with
>> the way cento attempts to listen to dummy interfaces?
>> _______________________________________________
>> Ntop-misc mailing list
>> Ntop-misc@listgateway.unipi.it
>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
_______________________________________________
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc

This looks like a bug. Please file an issue on https://github.com/ntop/PF_RING/issues <https://github.com/ntop/PF_RING/issues>

Luca

> On 3 Oct 2016, at 19:06, Jeremy Ashton <jeremy.ashton@shopify.com> wrote:
>
> Here is the deal. If I configure zbalance_ipc listen on 4x interfaces
> and then map those queues to dummy interfaces; Cento shows the
> bandwidth 100x more than reality. i.e. it shows 27.91Gbps whereas it
> is actually ~279 Mbit/s.
>
> pfcount on dummy0 interface:
> $ sudo pfcount -i dummy0 -c 100
>
> =========================
> Absolute Stats: [152'733 pkts total][0 pkts dropped][0.0% dropped]
> [152'733 pkts rcvd][108'744'822 bytes rcvd][50'907.23 pkt/sec][289.96 Mbit/sec]
> =========================
> Actual Stats: [41'132 pkts rcvd][1'000.05 ms][41'129.73 pps][0.25 Gbps]
> =========================
>
> =========================
> Absolute Stats: [189'340 pkts total][0 pkts dropped][0.0% dropped]
> [189'340 pkts rcvd][134'926'703 bytes rcvd][47'331.02 pkt/sec][269.83 Mbit/sec]
> =========================
> Actual Stats: [36'607 pkts rcvd][1'000.11 ms][36'602.82 pps][0.21 Gbps]
> =========================
>
>
> cento on dummy0 interface (should be 1/4 of total bandwidth):
> $ sudo /usr/local/bin/zbalance_ipc -i
> zc:<int1>,zc:<int2>,zc:<int3>,zc:<int4> -c10 -n4 -m1 -g0 -u
> /mnt/hugepages/ -r 0:dummy0 -r 1:dummy1 -r 2:dummy2 -r 3:dummy3
> $ sudo cento -i dummy0
> 03/Oct/2016 16:58:26 [NetworkInterface.cpp:990] [dummy0] [12'458'091
> pps/27.91 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
> pkt drops][0 TX pps]
> 03/Oct/2016 16:58:27 [NetworkInterface.cpp:990] [dummy0] [12'447'559
> pps/27.88 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
> pkt drops][0 TX pps]
> 03/Oct/2016 16:58:28 [NetworkInterface.cpp:990] [dummy0] [12'753'627
> pps/28.57 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
> pkt drops][0 TX pps]
> 03/Oct/2016 16:58:29 [NetworkInterface.cpp:990] [dummy0] [12'385'380
> pps/27.74 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
> pkt drops][0 TX pps]
> 03/Oct/2016 16:58:30 [NetworkInterface.cpp:990] [dummy0] [12’261'717
> pps/27.47 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
> pkt drops][0 TX pps]
>
> cento on raw interface with zc:
> $ sudo cento -i zc:<int1> -i zc:<int2> -i zc:<int3> -i zc:<int4> -g
> 1,2,3,4 -C 100 -H
> 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int1>] [0
> pps/0.00 Gbps][3’966/0/0/512’000 act/exp/drop/max flows][137’492/0
> RX/TX pkt drops][0 TX pps]
> 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int2>] [0
> pps/0.00 Gbps][1’960/0/0/512’000 act/exp/drop/max flows][34’004/0
> RX/TX pkt drops][0 TX pps]
> 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int3>] [0
> pps/0.00 Gbps][9’583/0/0/512’000 act/exp/drop/max flows][125’445/0
> RX/TX pkt drops][0 TX pps]
> 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int4>] [0
> pps/0.00 Gbps][1/0/0/512’000 act/exp/drop/max flows][0/0 RX/TX put
> drops][0 TX pps]
>
> On Mon, Oct 3, 2016 at 10:14 AM, Luca Deri <deri@ntop.org> wrote:
>> Jeremy,
>> I annoy sure I understand. in essence you have attached cento to zbalance_ipc queues, and the traffic rates are not correct? What you see with pfcount instead?
>>
>> This said, what do you want to do exactly? Perhaps use cento as flow-generator and attach bro to it on balanced egress queues?
>>
>> Regards luca
>>
>>> On 3 Oct 2016, at 16:04, Jeremy Ashton <jeremy.ashton@shopify.com> wrote:
>>>
>>> After following these instructions:
>>> http://www.ntop.org/pf_ring/best-practices-for-using-bro_ids-with-pf_ring-zc-reliably/
>>>
>>> The actual command was like the following:
>>>
>>> zbalance_ipc -i zc:<link1>,zc:<link2>,zc:<link3>,zc:<link4> -n 4 -m 1
>>> -c 2 -r 0:dummy0 -r 1:dummy1 -r 2:dummy2 -r 3:dummy3
>>>
>>>
>>> I found it was reporting something like the following:
>>>
>>> 27/Sep/2016 18:17:56 [NetworkInterface.cpp:990] [dummy0] [8'854'686
>>> pps/19.83 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
>>> pkt drops][0 TX pps]
>>>
>>> 27/Sep/2016 18:17:56 [NetworkInterface.cpp:990] [dummy1] [18’428'232
>>> pps/41.28 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
>>> pkt drops][0 TX pps]
>>>
>>>
>>> If I configure cento to listen to the interfaces directly, I see that
>>> there is <5Gbit aggregate bandwidth. Is there something strange with
>>> the way cento attempts to listen to dummy interfaces?
>>> _______________________________________________
>>> Ntop-misc mailing list
>>> Ntop-misc@listgateway.unipi.it
>>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>
>> _______________________________________________
>> Ntop-misc mailing list
>> Ntop-misc@listgateway.unipi.it
>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc

Please note “dummy” is a special name for cento, in this case it runs an internal traffic generator able to
simulate a capture interface producing synthetic traffic in order to test pure processing performance, in
essence the real interface is just ignored, please try renaming the interface (before running zbalance/cento) with:

ip link set dummy0 name myname0

Alfredo

> On 3 Oct 2016, at 19:07, Luca Deri <deri@ntop.org> wrote:
>
> This looks like a bug. Please file an issue on https://github.com/ntop/PF_RING/issues <https://github.com/ntop/PF_RING/issues>
>
> Luca
>
>> On 3 Oct 2016, at 19:06, Jeremy Ashton <jeremy.ashton@shopify.com <mailto:jeremy.ashton@shopify.com>> wrote:
>>
>> Here is the deal. If I configure zbalance_ipc listen on 4x interfaces
>> and then map those queues to dummy interfaces; Cento shows the
>> bandwidth 100x more than reality. i.e. it shows 27.91Gbps whereas it
>> is actually ~279 Mbit/s.
>>
>> pfcount on dummy0 interface:
>> $ sudo pfcount -i dummy0 -c 100
>>
>> =========================
>> Absolute Stats: [152'733 pkts total][0 pkts dropped][0.0% dropped]
>> [152'733 pkts rcvd][108'744'822 bytes rcvd][50'907.23 pkt/sec][289.96 Mbit/sec]
>> =========================
>> Actual Stats: [41'132 pkts rcvd][1'000.05 ms][41'129.73 pps][0.25 Gbps]
>> =========================
>>
>> =========================
>> Absolute Stats: [189'340 pkts total][0 pkts dropped][0.0% dropped]
>> [189'340 pkts rcvd][134'926'703 bytes rcvd][47'331.02 pkt/sec][269.83 Mbit/sec]
>> =========================
>> Actual Stats: [36'607 pkts rcvd][1'000.11 ms][36'602.82 pps][0.21 Gbps]
>> =========================
>>
>>
>> cento on dummy0 interface (should be 1/4 of total bandwidth):
>> $ sudo /usr/local/bin/zbalance_ipc -i
>> zc:<int1>,zc:<int2>,zc:<int3>,zc:<int4> -c10 -n4 -m1 -g0 -u
>> /mnt/hugepages/ -r 0:dummy0 -r 1:dummy1 -r 2:dummy2 -r 3:dummy3
>> $ sudo cento -i dummy0
>> 03/Oct/2016 16:58:26 [NetworkInterface.cpp:990] [dummy0] [12'458'091
>> pps/27.91 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
>> pkt drops][0 TX pps]
>> 03/Oct/2016 16:58:27 [NetworkInterface.cpp:990] [dummy0] [12'447'559
>> pps/27.88 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
>> pkt drops][0 TX pps]
>> 03/Oct/2016 16:58:28 [NetworkInterface.cpp:990] [dummy0] [12'753'627
>> pps/28.57 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
>> pkt drops][0 TX pps]
>> 03/Oct/2016 16:58:29 [NetworkInterface.cpp:990] [dummy0] [12'385'380
>> pps/27.74 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
>> pkt drops][0 TX pps]
>> 03/Oct/2016 16:58:30 [NetworkInterface.cpp:990] [dummy0] [12’261'717
>> pps/27.47 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
>> pkt drops][0 TX pps]
>>
>> cento on raw interface with zc:
>> $ sudo cento -i zc:<int1> -i zc:<int2> -i zc:<int3> -i zc:<int4> -g
>> 1,2,3,4 -C 100 -H
>> 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int1>] [0
>> pps/0.00 Gbps][3’966/0/0/512’000 act/exp/drop/max flows][137’492/0
>> RX/TX pkt drops][0 TX pps]
>> 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int2>] [0
>> pps/0.00 Gbps][1’960/0/0/512’000 act/exp/drop/max flows][34’004/0
>> RX/TX pkt drops][0 TX pps]
>> 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int3>] [0
>> pps/0.00 Gbps][9’583/0/0/512’000 act/exp/drop/max flows][125’445/0
>> RX/TX pkt drops][0 TX pps]
>> 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int4>] [0
>> pps/0.00 Gbps][1/0/0/512’000 act/exp/drop/max flows][0/0 RX/TX put
>> drops][0 TX pps]
>>
>> On Mon, Oct 3, 2016 at 10:14 AM, Luca Deri <deri@ntop.org <mailto:deri@ntop.org>> wrote:
>>> Jeremy,
>>> I annoy sure I understand. in essence you have attached cento to zbalance_ipc queues, and the traffic rates are not correct? What you see with pfcount instead?
>>>
>>> This said, what do you want to do exactly? Perhaps use cento as flow-generator and attach bro to it on balanced egress queues?
>>>
>>> Regards luca
>>>
>>>> On 3 Oct 2016, at 16:04, Jeremy Ashton <jeremy.ashton@shopify.com <mailto:jeremy.ashton@shopify.com>> wrote:
>>>>
>>>> After following these instructions:
>>>> http://www.ntop.org/pf_ring/best-practices-for-using-bro_ids-with-pf_ring-zc-reliably/ <http://www.ntop.org/pf_ring/best-practices-for-using-bro_ids-with-pf_ring-zc-reliably/>
>>>>
>>>> The actual command was like the following:
>>>>
>>>> zbalance_ipc -i zc:<link1>,zc:<link2>,zc:<link3>,zc:<link4> -n 4 -m 1
>>>> -c 2 -r 0:dummy0 -r 1:dummy1 -r 2:dummy2 -r 3:dummy3
>>>>
>>>>
>>>> I found it was reporting something like the following:
>>>>
>>>> 27/Sep/2016 18:17:56 [NetworkInterface.cpp:990] [dummy0] [8'854'686
>>>> pps/19.83 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
>>>> pkt drops][0 TX pps]
>>>>
>>>> 27/Sep/2016 18:17:56 [NetworkInterface.cpp:990] [dummy1] [18’428'232
>>>> pps/41.28 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
>>>> pkt drops][0 TX pps]
>>>>
>>>>
>>>> If I configure cento to listen to the interfaces directly, I see that
>>>> there is <5Gbit aggregate bandwidth. Is there something strange with
>>>> the way cento attempts to listen to dummy interfaces?
>>>> _______________________________________________
>>>> Ntop-misc mailing list
>>>> Ntop-misc@listgateway.unipi.it
>>>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>>
>>> _______________________________________________
>>> Ntop-misc mailing list
>>> Ntop-misc@listgateway.unipi.it <mailto:Ntop-misc@listgateway.unipi.it>
>>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>> _______________________________________________
>> Ntop-misc mailing list
>> Ntop-misc@listgateway.unipi.it <mailto:Ntop-misc@listgateway.unipi.it>
>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc

Would you also update the documentation on
http://www.ntop.org/pf_ring/best-practices-for-using-bro_ids-with-pf_ring-zc-reliably/
to reflect this? I followed these and this is what caused it. :(

On Mon, Oct 3, 2016 at 3:16 PM, Alfredo Cardigliano
<cardigliano@ntop.org> wrote:
> Please note “dummy” is a special name for cento, in this case it runs an
> internal traffic generator able to
> simulate a capture interface producing synthetic traffic in order to test
> pure processing performance, in
> essence the real interface is just ignored, please try renaming the
> interface (before running zbalance/cento) with:
>
> ip link set dummy0 name myname0
>
> Alfredo
>
> On 3 Oct 2016, at 19:07, Luca Deri <deri@ntop.org> wrote:
>
> This looks like a bug. Please file an issue on
> https://github.com/ntop/PF_RING/issues
>
> Luca
>
> On 3 Oct 2016, at 19:06, Jeremy Ashton <jeremy.ashton@shopify.com> wrote:
>
> Here is the deal. If I configure zbalance_ipc listen on 4x interfaces
> and then map those queues to dummy interfaces; Cento shows the
> bandwidth 100x more than reality. i.e. it shows 27.91Gbps whereas it
> is actually ~279 Mbit/s.
>
> pfcount on dummy0 interface:
> $ sudo pfcount -i dummy0 -c 100
>
> =========================
> Absolute Stats: [152'733 pkts total][0 pkts dropped][0.0% dropped]
> [152'733 pkts rcvd][108'744'822 bytes rcvd][50'907.23 pkt/sec][289.96
> Mbit/sec]
> =========================
> Actual Stats: [41'132 pkts rcvd][1'000.05 ms][41'129.73 pps][0.25 Gbps]
> =========================
>
> =========================
> Absolute Stats: [189'340 pkts total][0 pkts dropped][0.0% dropped]
> [189'340 pkts rcvd][134'926'703 bytes rcvd][47'331.02 pkt/sec][269.83
> Mbit/sec]
> =========================
> Actual Stats: [36'607 pkts rcvd][1'000.11 ms][36'602.82 pps][0.21 Gbps]
> =========================
>
>
> cento on dummy0 interface (should be 1/4 of total bandwidth):
> $ sudo /usr/local/bin/zbalance_ipc -i
> zc:<int1>,zc:<int2>,zc:<int3>,zc:<int4> -c10 -n4 -m1 -g0 -u
> /mnt/hugepages/ -r 0:dummy0 -r 1:dummy1 -r 2:dummy2 -r 3:dummy3
> $ sudo cento -i dummy0
> 03/Oct/2016 16:58:26 [NetworkInterface.cpp:990] [dummy0] [12'458'091
> pps/27.91 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
> pkt drops][0 TX pps]
> 03/Oct/2016 16:58:27 [NetworkInterface.cpp:990] [dummy0] [12'447'559
> pps/27.88 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
> pkt drops][0 TX pps]
> 03/Oct/2016 16:58:28 [NetworkInterface.cpp:990] [dummy0] [12'753'627
> pps/28.57 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
> pkt drops][0 TX pps]
> 03/Oct/2016 16:58:29 [NetworkInterface.cpp:990] [dummy0] [12'385'380
> pps/27.74 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
> pkt drops][0 TX pps]
> 03/Oct/2016 16:58:30 [NetworkInterface.cpp:990] [dummy0] [12’261'717
> pps/27.47 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
> pkt drops][0 TX pps]
>
> cento on raw interface with zc:
> $ sudo cento -i zc:<int1> -i zc:<int2> -i zc:<int3> -i zc:<int4> -g
> 1,2,3,4 -C 100 -H
> 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int1>] [0
> pps/0.00 Gbps][3’966/0/0/512’000 act/exp/drop/max flows][137’492/0
> RX/TX pkt drops][0 TX pps]
> 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int2>] [0
> pps/0.00 Gbps][1’960/0/0/512’000 act/exp/drop/max flows][34’004/0
> RX/TX pkt drops][0 TX pps]
> 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int3>] [0
> pps/0.00 Gbps][9’583/0/0/512’000 act/exp/drop/max flows][125’445/0
> RX/TX pkt drops][0 TX pps]
> 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int4>] [0
> pps/0.00 Gbps][1/0/0/512’000 act/exp/drop/max flows][0/0 RX/TX put
> drops][0 TX pps]
>
> On Mon, Oct 3, 2016 at 10:14 AM, Luca Deri <deri@ntop.org> wrote:
>
> Jeremy,
> I annoy sure I understand. in essence you have attached cento to
> zbalance_ipc queues, and the traffic rates are not correct? What you see
> with pfcount instead?
>
> This said, what do you want to do exactly? Perhaps use cento as
> flow-generator and attach bro to it on balanced egress queues?
>
> Regards luca
>
> On 3 Oct 2016, at 16:04, Jeremy Ashton <jeremy.ashton@shopify.com> wrote:
>
> After following these instructions:
> http://www.ntop.org/pf_ring/best-practices-for-using-bro_ids-with-pf_ring-zc-reliably/
>
> The actual command was like the following:
>
> zbalance_ipc -i zc:<link1>,zc:<link2>,zc:<link3>,zc:<link4> -n 4 -m 1
> -c 2 -r 0:dummy0 -r 1:dummy1 -r 2:dummy2 -r 3:dummy3
>
>
> I found it was reporting something like the following:
>
> 27/Sep/2016 18:17:56 [NetworkInterface.cpp:990] [dummy0] [8'854'686
> pps/19.83 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
> pkt drops][0 TX pps]
>
> 27/Sep/2016 18:17:56 [NetworkInterface.cpp:990] [dummy1] [18’428'232
> pps/41.28 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
> pkt drops][0 TX pps]
>
>
> If I configure cento to listen to the interfaces directly, I see that
> there is <5Gbit aggregate bandwidth. Is there something strange with
> the way cento attempts to listen to dummy interfaces?
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
>
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
>
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
>
>
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
_______________________________________________
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc

Hi Jeremy
please note the post is correct and it still applies to PF_RING/ZC,
your issue is due to a name clash in Cento.
BTW, what do you want to do in practice? Why are you using zbalance with cento?

Alfredo

> On 3 Oct 2016, at 21:40, Jeremy Ashton <jeremy.ashton@shopify.com> wrote:
>
> Would you also update the documentation on
> http://www.ntop.org/pf_ring/best-practices-for-using-bro_ids-with-pf_ring-zc-reliably/
> to reflect this? I followed these and this is what caused it. :(
>
> On Mon, Oct 3, 2016 at 3:16 PM, Alfredo Cardigliano
> <cardigliano@ntop.org> wrote:
>> Please note “dummy” is a special name for cento, in this case it runs an
>> internal traffic generator able to
>> simulate a capture interface producing synthetic traffic in order to test
>> pure processing performance, in
>> essence the real interface is just ignored, please try renaming the
>> interface (before running zbalance/cento) with:
>>
>> ip link set dummy0 name myname0
>>
>> Alfredo
>>
>> On 3 Oct 2016, at 19:07, Luca Deri <deri@ntop.org> wrote:
>>
>> This looks like a bug. Please file an issue on
>> https://github.com/ntop/PF_RING/issues
>>
>> Luca
>>
>> On 3 Oct 2016, at 19:06, Jeremy Ashton <jeremy.ashton@shopify.com> wrote:
>>
>> Here is the deal. If I configure zbalance_ipc listen on 4x interfaces
>> and then map those queues to dummy interfaces; Cento shows the
>> bandwidth 100x more than reality. i.e. it shows 27.91Gbps whereas it
>> is actually ~279 Mbit/s.
>>
>> pfcount on dummy0 interface:
>> $ sudo pfcount -i dummy0 -c 100
>>
>> =========================
>> Absolute Stats: [152'733 pkts total][0 pkts dropped][0.0% dropped]
>> [152'733 pkts rcvd][108'744'822 bytes rcvd][50'907.23 pkt/sec][289.96
>> Mbit/sec]
>> =========================
>> Actual Stats: [41'132 pkts rcvd][1'000.05 ms][41'129.73 pps][0.25 Gbps]
>> =========================
>>
>> =========================
>> Absolute Stats: [189'340 pkts total][0 pkts dropped][0.0% dropped]
>> [189'340 pkts rcvd][134'926'703 bytes rcvd][47'331.02 pkt/sec][269.83
>> Mbit/sec]
>> =========================
>> Actual Stats: [36'607 pkts rcvd][1'000.11 ms][36'602.82 pps][0.21 Gbps]
>> =========================
>>
>>
>> cento on dummy0 interface (should be 1/4 of total bandwidth):
>> $ sudo /usr/local/bin/zbalance_ipc -i
>> zc:<int1>,zc:<int2>,zc:<int3>,zc:<int4> -c10 -n4 -m1 -g0 -u
>> /mnt/hugepages/ -r 0:dummy0 -r 1:dummy1 -r 2:dummy2 -r 3:dummy3
>> $ sudo cento -i dummy0
>> 03/Oct/2016 16:58:26 [NetworkInterface.cpp:990] [dummy0] [12'458'091
>> pps/27.91 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
>> pkt drops][0 TX pps]
>> 03/Oct/2016 16:58:27 [NetworkInterface.cpp:990] [dummy0] [12'447'559
>> pps/27.88 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
>> pkt drops][0 TX pps]
>> 03/Oct/2016 16:58:28 [NetworkInterface.cpp:990] [dummy0] [12'753'627
>> pps/28.57 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
>> pkt drops][0 TX pps]
>> 03/Oct/2016 16:58:29 [NetworkInterface.cpp:990] [dummy0] [12'385'380
>> pps/27.74 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
>> pkt drops][0 TX pps]
>> 03/Oct/2016 16:58:30 [NetworkInterface.cpp:990] [dummy0] [12’261'717
>> pps/27.47 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
>> pkt drops][0 TX pps]
>>
>> cento on raw interface with zc:
>> $ sudo cento -i zc:<int1> -i zc:<int2> -i zc:<int3> -i zc:<int4> -g
>> 1,2,3,4 -C 100 -H
>> 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int1>] [0
>> pps/0.00 Gbps][3’966/0/0/512’000 act/exp/drop/max flows][137’492/0
>> RX/TX pkt drops][0 TX pps]
>> 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int2>] [0
>> pps/0.00 Gbps][1’960/0/0/512’000 act/exp/drop/max flows][34’004/0
>> RX/TX pkt drops][0 TX pps]
>> 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int3>] [0
>> pps/0.00 Gbps][9’583/0/0/512’000 act/exp/drop/max flows][125’445/0
>> RX/TX pkt drops][0 TX pps]
>> 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int4>] [0
>> pps/0.00 Gbps][1/0/0/512’000 act/exp/drop/max flows][0/0 RX/TX put
>> drops][0 TX pps]
>>
>> On Mon, Oct 3, 2016 at 10:14 AM, Luca Deri <deri@ntop.org> wrote:
>>
>> Jeremy,
>> I annoy sure I understand. in essence you have attached cento to
>> zbalance_ipc queues, and the traffic rates are not correct? What you see
>> with pfcount instead?
>>
>> This said, what do you want to do exactly? Perhaps use cento as
>> flow-generator and attach bro to it on balanced egress queues?
>>
>> Regards luca
>>
>> On 3 Oct 2016, at 16:04, Jeremy Ashton <jeremy.ashton@shopify.com> wrote:
>>
>> After following these instructions:
>> http://www.ntop.org/pf_ring/best-practices-for-using-bro_ids-with-pf_ring-zc-reliably/
>>
>> The actual command was like the following:
>>
>> zbalance_ipc -i zc:<link1>,zc:<link2>,zc:<link3>,zc:<link4> -n 4 -m 1
>> -c 2 -r 0:dummy0 -r 1:dummy1 -r 2:dummy2 -r 3:dummy3
>>
>>
>> I found it was reporting something like the following:
>>
>> 27/Sep/2016 18:17:56 [NetworkInterface.cpp:990] [dummy0] [8'854'686
>> pps/19.83 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
>> pkt drops][0 TX pps]
>>
>> 27/Sep/2016 18:17:56 [NetworkInterface.cpp:990] [dummy1] [18’428'232
>> pps/41.28 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
>> pkt drops][0 TX pps]
>>
>>
>> If I configure cento to listen to the interfaces directly, I see that
>> there is <5Gbit aggregate bandwidth. Is there something strange with
>> the way cento attempts to listen to dummy interfaces?
>> _______________________________________________
>> Ntop-misc mailing list
>> Ntop-misc@listgateway.unipi.it
>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>
>>
>> _______________________________________________
>> Ntop-misc mailing list
>> Ntop-misc@listgateway.unipi.it
>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>
>> _______________________________________________
>> Ntop-misc mailing list
>> Ntop-misc@listgateway.unipi.it
>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>
>>
>> _______________________________________________
>> Ntop-misc mailing list
>> Ntop-misc@listgateway.unipi.it
>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>
>>
>>
>> _______________________________________________
>> Ntop-misc mailing list
>> Ntop-misc@listgateway.unipi.it
>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc

_______________________________________________
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc

Currently I need to use zbalance_ipc because cento does not currently
support multiple aggregated-egress-queues. Our use case is as
follows:

We have a number of 10Gbps links which are being aggregated by
zbalance_ipc and then it creates (n) aggregated queues. One of the
queues is connected to cento and then n2disk (via
aggregated-egress-queue) and also bro through balanced-egress-queue.
Another of the aggregated queues is made available as a test port for
tcpdump. This is certainly not ideal but it is all we can do in the
meantime.

On Mon, Oct 3, 2016 at 3:45 PM, Alfredo Cardigliano
<cardigliano@ntop.org> wrote:
> Hi Jeremy
> please note the post is correct and it still applies to PF_RING/ZC,
> your issue is due to a name clash in Cento.
> BTW, what do you want to do in practice? Why are you using zbalance with cento?
>
> Alfredo
>
>> On 3 Oct 2016, at 21:40, Jeremy Ashton <jeremy.ashton@shopify.com> wrote:
>>
>> Would you also update the documentation on
>> http://www.ntop.org/pf_ring/best-practices-for-using-bro_ids-with-pf_ring-zc-reliably/
>> to reflect this? I followed these and this is what caused it. :(
>>
>> On Mon, Oct 3, 2016 at 3:16 PM, Alfredo Cardigliano
>> <cardigliano@ntop.org> wrote:
>>> Please note “dummy” is a special name for cento, in this case it runs an
>>> internal traffic generator able to
>>> simulate a capture interface producing synthetic traffic in order to test
>>> pure processing performance, in
>>> essence the real interface is just ignored, please try renaming the
>>> interface (before running zbalance/cento) with:
>>>
>>> ip link set dummy0 name myname0
>>>
>>> Alfredo
>>>
>>> On 3 Oct 2016, at 19:07, Luca Deri <deri@ntop.org> wrote:
>>>
>>> This looks like a bug. Please file an issue on
>>> https://github.com/ntop/PF_RING/issues
>>>
>>> Luca
>>>
>>> On 3 Oct 2016, at 19:06, Jeremy Ashton <jeremy.ashton@shopify.com> wrote:
>>>
>>> Here is the deal. If I configure zbalance_ipc listen on 4x interfaces
>>> and then map those queues to dummy interfaces; Cento shows the
>>> bandwidth 100x more than reality. i.e. it shows 27.91Gbps whereas it
>>> is actually ~279 Mbit/s.
>>>
>>> pfcount on dummy0 interface:
>>> $ sudo pfcount -i dummy0 -c 100
>>>
>>> =========================
>>> Absolute Stats: [152'733 pkts total][0 pkts dropped][0.0% dropped]
>>> [152'733 pkts rcvd][108'744'822 bytes rcvd][50'907.23 pkt/sec][289.96
>>> Mbit/sec]
>>> =========================
>>> Actual Stats: [41'132 pkts rcvd][1'000.05 ms][41'129.73 pps][0.25 Gbps]
>>> =========================
>>>
>>> =========================
>>> Absolute Stats: [189'340 pkts total][0 pkts dropped][0.0% dropped]
>>> [189'340 pkts rcvd][134'926'703 bytes rcvd][47'331.02 pkt/sec][269.83
>>> Mbit/sec]
>>> =========================
>>> Actual Stats: [36'607 pkts rcvd][1'000.11 ms][36'602.82 pps][0.21 Gbps]
>>> =========================
>>>
>>>
>>> cento on dummy0 interface (should be 1/4 of total bandwidth):
>>> $ sudo /usr/local/bin/zbalance_ipc -i
>>> zc:<int1>,zc:<int2>,zc:<int3>,zc:<int4> -c10 -n4 -m1 -g0 -u
>>> /mnt/hugepages/ -r 0:dummy0 -r 1:dummy1 -r 2:dummy2 -r 3:dummy3
>>> $ sudo cento -i dummy0
>>> 03/Oct/2016 16:58:26 [NetworkInterface.cpp:990] [dummy0] [12'458'091
>>> pps/27.91 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
>>> pkt drops][0 TX pps]
>>> 03/Oct/2016 16:58:27 [NetworkInterface.cpp:990] [dummy0] [12'447'559
>>> pps/27.88 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
>>> pkt drops][0 TX pps]
>>> 03/Oct/2016 16:58:28 [NetworkInterface.cpp:990] [dummy0] [12'753'627
>>> pps/28.57 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
>>> pkt drops][0 TX pps]
>>> 03/Oct/2016 16:58:29 [NetworkInterface.cpp:990] [dummy0] [12'385'380
>>> pps/27.74 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
>>> pkt drops][0 TX pps]
>>> 03/Oct/2016 16:58:30 [NetworkInterface.cpp:990] [dummy0] [12’261'717
>>> pps/27.47 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
>>> pkt drops][0 TX pps]
>>>
>>> cento on raw interface with zc:
>>> $ sudo cento -i zc:<int1> -i zc:<int2> -i zc:<int3> -i zc:<int4> -g
>>> 1,2,3,4 -C 100 -H
>>> 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int1>] [0
>>> pps/0.00 Gbps][3’966/0/0/512’000 act/exp/drop/max flows][137’492/0
>>> RX/TX pkt drops][0 TX pps]
>>> 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int2>] [0
>>> pps/0.00 Gbps][1’960/0/0/512’000 act/exp/drop/max flows][34’004/0
>>> RX/TX pkt drops][0 TX pps]
>>> 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int3>] [0
>>> pps/0.00 Gbps][9’583/0/0/512’000 act/exp/drop/max flows][125’445/0
>>> RX/TX pkt drops][0 TX pps]
>>> 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int4>] [0
>>> pps/0.00 Gbps][1/0/0/512’000 act/exp/drop/max flows][0/0 RX/TX put
>>> drops][0 TX pps]
>>>
>>> On Mon, Oct 3, 2016 at 10:14 AM, Luca Deri <deri@ntop.org> wrote:
>>>
>>> Jeremy,
>>> I annoy sure I understand. in essence you have attached cento to
>>> zbalance_ipc queues, and the traffic rates are not correct? What you see
>>> with pfcount instead?
>>>
>>> This said, what do you want to do exactly? Perhaps use cento as
>>> flow-generator and attach bro to it on balanced egress queues?
>>>
>>> Regards luca
>>>
>>> On 3 Oct 2016, at 16:04, Jeremy Ashton <jeremy.ashton@shopify.com> wrote:
>>>
>>> After following these instructions:
>>> http://www.ntop.org/pf_ring/best-practices-for-using-bro_ids-with-pf_ring-zc-reliably/
>>>
>>> The actual command was like the following:
>>>
>>> zbalance_ipc -i zc:<link1>,zc:<link2>,zc:<link3>,zc:<link4> -n 4 -m 1
>>> -c 2 -r 0:dummy0 -r 1:dummy1 -r 2:dummy2 -r 3:dummy3
>>>
>>>
>>> I found it was reporting something like the following:
>>>
>>> 27/Sep/2016 18:17:56 [NetworkInterface.cpp:990] [dummy0] [8'854'686
>>> pps/19.83 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
>>> pkt drops][0 TX pps]
>>>
>>> 27/Sep/2016 18:17:56 [NetworkInterface.cpp:990] [dummy1] [18’428'232
>>> pps/41.28 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX
>>> pkt drops][0 TX pps]
>>>
>>>
>>> If I configure cento to listen to the interfaces directly, I see that
>>> there is <5Gbit aggregate bandwidth. Is there something strange with
>>> the way cento attempts to listen to dummy interfaces?
>>> _______________________________________________
>>> Ntop-misc mailing list
>>> Ntop-misc@listgateway.unipi.it
>>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>>
>>>
>>> _______________________________________________
>>> Ntop-misc mailing list
>>> Ntop-misc@listgateway.unipi.it
>>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>>
>>> _______________________________________________
>>> Ntop-misc mailing list
>>> Ntop-misc@listgateway.unipi.it
>>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>>
>>>
>>> _______________________________________________
>>> Ntop-misc mailing list
>>> Ntop-misc@listgateway.unipi.it
>>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>>
>>>
>>>
>>> _______________________________________________
>>> Ntop-misc mailing list
>>> Ntop-misc@listgateway.unipi.it
>>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>> _______________________________________________
>> Ntop-misc mailing list
>> Ntop-misc@listgateway.unipi.it
>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
_______________________________________________
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc