Mailing List Archive

Hi Chandrika
a few quesitons:
- are you talking about defragmentation?
- what do you mean with "callback”?
- what drivers are you using?
Please note that in case of defragmentation, the pf_ring kernel module is using the linux ip_defrag() functionality.

Alfredo

> On 3 Nov 2016, at 06:36, Chandrika Gautam <chandrika.iitd.rock@gmail.com> wrote:
>
> Hi,
>
> I am using PFRING 6.2.0 and enabled fragmentation in PFRING but PFRING is not giving a callback on the attached packets having two fragments (first fragment is smaller and latter one is bigger).
> Can you please help us to understand how does fragmentation work in PFRING.
>
> How many simultaneous ip fragments it can cater(hash size) and what is the timeout for fragments?
>
> Regards,
> C.G.
> <fragments_testcase2_orig.pcap>_______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc

_______________________________________________
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc

Hi Alfredo,

Let me rephrase the problem I am facing some problem when fragmentation is
enabled in PFRING.

Please find the attachment trace where there are total 18 fragmented
packets(9 complete packets), out of which PFRING is assembling only 1.

These packets having some padding bytes which PFRING seems not able to
decode and assemble correctly.

Regards,
Chandrika

On Thu, Nov 3, 2016 at 2:34 PM, Alfredo Cardigliano <cardigliano@ntop.org>
wrote:

> Hi Chandrika
> a few quesitons:
> - are you talking about defragmentation?
> - what do you mean with "callback”?
> - what drivers are you using?
> Please note that in case of defragmentation, the pf_ring kernel module is
> using the linux ip_defrag() functionality.
>
> Alfredo
>
> > On 3 Nov 2016, at 06:36, Chandrika Gautam <chandrika.iitd.rock@gmail.com>
> wrote:
> >
> > Hi,
> >
> > I am using PFRING 6.2.0 and enabled fragmentation in PFRING but PFRING
> is not giving a callback on the attached packets having two fragments
> (first fragment is smaller and latter one is bigger).
> > Can you please help us to understand how does fragmentation work in
> PFRING.
> >
> > How many simultaneous ip fragments it can cater(hash size) and what is
> the timeout for fragments?
> >
> > Regards,
> > C.G.
> > <fragments_testcase2_orig.pcap>_________________________
> ______________________
> > Ntop-misc mailing list
> > Ntop-misc@listgateway.unipi.it
> > http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc

Hi Chandrika
in PF_RING we rely on kernel defragmentation routines, it’s not our code. As the kernel code is designed to work per socket and not in in the wild, this could be the issue. I suggest to defragment in user-space as your traffic seems to be heavily fragmented (BTW why don’t you increase the MTU?)

Luca


> On 9 Nov 2016, at 08:20, Chandrika Gautam <chandrika.iitd.rock@gmail.com> wrote:
>
> Hi Alfredo,
>
> Let me rephrase the problem I am facing some problem when fragmentation is enabled in PFRING.
>
> Please find the attachment trace where there are total 18 fragmented packets(9 complete packets), out of which PFRING is assembling only 1.
>
> These packets having some padding bytes which PFRING seems not able to decode and assemble correctly.
>
> Regards,
> Chandrika
>
> On Thu, Nov 3, 2016 at 2:34 PM, Alfredo Cardigliano <cardigliano@ntop.org <mailto:cardigliano@ntop.org>> wrote:
> Hi Chandrika
> a few quesitons:
> - are you talking about defragmentation?
> - what do you mean with "callback”?
> - what drivers are you using?
> Please note that in case of defragmentation, the pf_ring kernel module is using the linux ip_defrag() functionality.
>
> Alfredo
>
> > On 3 Nov 2016, at 06:36, Chandrika Gautam <chandrika.iitd.rock@gmail.com <mailto:chandrika.iitd.rock@gmail.com>> wrote:
> >
> > Hi,
> >
> > I am using PFRING 6.2.0 and enabled fragmentation in PFRING but PFRING is not giving a callback on the attached packets having two fragments (first fragment is smaller and latter one is bigger).
> > Can you please help us to understand how does fragmentation work in PFRING.
> >
> > How many simultaneous ip fragments it can cater(hash size) and what is the timeout for fragments?
> >
> > Regards,
> > C.G.
> > <fragments_testcase2_orig.pcap>_______________________________________________
> > Ntop-misc mailing list
> > Ntop-misc@listgateway.unipi.it <mailto:Ntop-misc@listgateway.unipi.it>
> > http://listgateway.unipi.it/mailman/listinfo/ntop-misc <http://listgateway.unipi.it/mailman/listinfo/ntop-misc>
>
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it <mailto:Ntop-misc@listgateway.unipi.it>
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc <http://listgateway.unipi.it/mailman/listinfo/ntop-misc>
> <docomo_fragments_2_case_loss_1.pcap>_______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc

Thanks for quick reply.
Our application is monitoring some traffic passively so increasing MTU will
not help here.

Regards,
Chandrika

On Wed, Nov 9, 2016 at 1:12 PM, Luca Deri <deri@ntop.org> wrote:

> Hi Chandrika
> in PF_RING we rely on kernel defragmentation routines, it’s not our code.
> As the kernel code is designed to work per socket and not in in the wild,
> this could be the issue. I suggest to defragment in user-space as your
> traffic seems to be heavily fragmented (BTW why don’t you increase the MTU?)
>
> Luca
>
>
> On 9 Nov 2016, at 08:20, Chandrika Gautam <chandrika.iitd.rock@gmail.com>
> wrote:
>
> Hi Alfredo,
>
> Let me rephrase the problem I am facing some problem when fragmentation is
> enabled in PFRING.
>
> Please find the attachment trace where there are total 18 fragmented
> packets(9 complete packets), out of which PFRING is assembling only 1.
>
> These packets having some padding bytes which PFRING seems not able to
> decode and assemble correctly.
>
> Regards,
> Chandrika
>
> On Thu, Nov 3, 2016 at 2:34 PM, Alfredo Cardigliano <cardigliano@ntop.org>
> wrote:
>
>> Hi Chandrika
>> a few quesitons:
>> - are you talking about defragmentation?
>> - what do you mean with "callback”?
>> - what drivers are you using?
>> Please note that in case of defragmentation, the pf_ring kernel module is
>> using the linux ip_defrag() functionality.
>>
>> Alfredo
>>
>> > On 3 Nov 2016, at 06:36, Chandrika Gautam <
>> chandrika.iitd.rock@gmail.com> wrote:
>> >
>> > Hi,
>> >
>> > I am using PFRING 6.2.0 and enabled fragmentation in PFRING but PFRING
>> is not giving a callback on the attached packets having two fragments
>> (first fragment is smaller and latter one is bigger).
>> > Can you please help us to understand how does fragmentation work in
>> PFRING.
>> >
>> > How many simultaneous ip fragments it can cater(hash size) and what is
>> the timeout for fragments?
>> >
>> > Regards,
>> > C.G.
>> > <fragments_testcase2_orig.pcap>_____________________________
>> __________________
>> > Ntop-misc mailing list
>> > Ntop-misc@listgateway.unipi.it
>> > http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>
>> _______________________________________________
>> Ntop-misc mailing list
>> Ntop-misc@listgateway.unipi.it
>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
>
> <docomo_fragments_2_case_loss_1.pcap>_______________________
> ________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
>
>
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>