Mailing List Archive: NTOPNG FreeBSD 10G interface

NTOPNG FreeBSD 10G interface

Feb 9, 2017, 5:39 AM

Post #1 of 5 (803 views)

Hello,

I've have installed ntopng 2.4.170208 - Community Edition from FreeBSD ports on a server running FreeBSD 11.0-RELEASE-p7.
The network card is an Intel Ethernet 10 Gigabit Converged Network Adapter X520-sr1.

I'm using port mirror to analyze a 10Gbps link.

The problem is that when I select the mirror interfaces - ix0 - I get the message:

No packet has been received yet on interface ix0.

On the same server is running FastNetMon, a DDoS detection tool, that use the same interface to analyze the traffic using netmap as traffic capture.
It's running fine.

If I run:

# systat -ifstat 1

I see the traffic on ix0 interfaces:

/0 /1 /2 /3 /4 /5 /6 /7 /8 /9 /10
Load Average |||||||||||||||||||

Interface Traffic Peak Total
lo0 in 368.304 KB/s 412.514 KB/s 127.259 GB
out 368.304 KB/s 412.514 KB/s 127.259 GB

bce0 in 14.956 KB/s 110.841 KB/s 2.656 GB
out 87.403 KB/s 3.438 MB/s 30.069 GB

ix0 in 287.174 MB/s 556.409 MB/s 39.230 TB
out 0.000 KB/s 0.000 KB/s 0.000 KB

How could be the problem ?
NTOPNG and FastNetMon can't run on the same server ?

Thanks a lot.

Ciao
Marco

--
Marco Pirovano
Infrastrutture e Tecnologie
Information and Communication Technology
Universita' Bocconi
via Gobbi, 5 - 20136 Milano
Tel. +39 02 5836.3173 Fax. +39 02 5836.3160

Windows makes noise, Linux plays music,
but BSD Rocks!
_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop

Re: NTOPNG FreeBSD 10G interface [ In reply to ]

deri at ntop

Feb 10, 2017, 1:10 AM

Post #2 of 5 (801 views)

Permalink

Marco
what is you do tcpdump -i ix0? Do you see any traffic?

Luca

On 02/09/2017 02:39 PM, Marco Pirovano wrote:
> Hello,
>
> I've have installed ntopng 2.4.170208 - Community Edition from FreeBSD ports on a server running FreeBSD 11.0-RELEASE-p7.
> The network card is an Intel Ethernet 10 Gigabit Converged Network Adapter X520-sr1.
>
> I'm using port mirror to analyze a 10Gbps link.
>
> The problem is that when I select the mirror interfaces - ix0 - I get the message:
>
> No packet has been received yet on interface ix0.
>
> On the same server is running FastNetMon, a DDoS detection tool, that use the same interface to analyze the traffic using netmap as traffic capture.
> It's running fine.
>
> If I run:
>
> # systat -ifstat 1
>
> I see the traffic on ix0 interfaces:
>
> /0 /1 /2 /3 /4 /5 /6 /7 /8 /9 /10
> Load Average |||||||||||||||||||
>
> Interface Traffic Peak Total
> lo0 in 368.304 KB/s 412.514 KB/s 127.259 GB
> out 368.304 KB/s 412.514 KB/s 127.259 GB
>
> bce0 in 14.956 KB/s 110.841 KB/s 2.656 GB
> out 87.403 KB/s 3.438 MB/s 30.069 GB
>
> ix0 in 287.174 MB/s 556.409 MB/s 39.230 TB
> out 0.000 KB/s 0.000 KB/s 0.000 KB
>
> How could be the problem ?
> NTOPNG and FastNetMon can't run on the same server ?
>
> Thanks a lot.
>
> Ciao
> Marco
>

_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop

Re: NTOPNG FreeBSD 10G interface [ In reply to ]

marco.pirovano at unibocconi

Feb 10, 2017, 1:20 AM

Post #3 of 5 (801 views)

Permalink

Luca,

no traffic for tcpdump -i ix0

Marco

----- Il 10-feb-17, alle 10:10, Luca Deri deri@ntop.org ha scritto:

> Marco
> what is you do tcpdump -i ix0? Do you see any traffic?
>
> Luca
>
> On 02/09/2017 02:39 PM, Marco Pirovano wrote:
>> Hello,
>>
>> I've have installed ntopng 2.4.170208 - Community Edition from FreeBSD ports on
>> a server running FreeBSD 11.0-RELEASE-p7.
>> The network card is an Intel Ethernet 10 Gigabit Converged Network Adapter
>> X520-sr1.
>>
>> I'm using port mirror to analyze a 10Gbps link.
>>
>> The problem is that when I select the mirror interfaces - ix0 - I get the
>> message:
>>
>> No packet has been received yet on interface ix0.
>>
>> On the same server is running FastNetMon, a DDoS detection tool, that use the
>> same interface to analyze the traffic using netmap as traffic capture.
>> It's running fine.
>>
>> If I run:
>>
>> # systat -ifstat 1
>>
>> I see the traffic on ix0 interfaces:
>>
>> /0 /1 /2 /3 /4 /5 /6 /7 /8 /9 /10
>> Load Average |||||||||||||||||||
>>
>> Interface Traffic Peak Total
>> lo0 in 368.304 KB/s 412.514 KB/s 127.259 GB
>> out 368.304 KB/s 412.514 KB/s 127.259 GB
>>
>> bce0 in 14.956 KB/s 110.841 KB/s 2.656 GB
>> out 87.403 KB/s 3.438 MB/s 30.069 GB
>>
>> ix0 in 287.174 MB/s 556.409 MB/s 39.230 TB
>> out 0.000 KB/s 0.000 KB/s 0.000 KB
>>
>> How could be the problem ?
>> NTOPNG and FastNetMon can't run on the same server ?
>>
>> Thanks a lot.
>>
>> Ciao
>> Marco
>>
>
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop

--
Marco Pirovano
Infrastrutture e Tecnologie
Information and Communication Technology
Universita' Bocconi
via Gobbi, 5 - 20136 Milano
Tel. +39 02 5836.3173 Fax. +39 02 5836.3160

Windows makes noise, Linux plays music,
but BSD Rocks!
_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop

Re: NTOPNG FreeBSD 10G interface [ In reply to ]

marco.pirovano at unibocconi

Feb 10, 2017, 2:46 AM

Post #4 of 5 (799 views)

Permalink

Luca,

if I stop FastNetMon NTOPNG works fine.

They can't run together on the same server :-(

Ciao
Marco

----- Il 10-feb-17, alle 10:20, Marco Pirovano marco.pirovano@unibocconi.it ha scritto:

> Luca,
>
> no traffic for tcpdump -i ix0
>
> Marco
>
> ----- Il 10-feb-17, alle 10:10, Luca Deri deri@ntop.org ha scritto:
>
>> Marco
>> what is you do tcpdump -i ix0? Do you see any traffic?
>>
>> Luca
>>
>> On 02/09/2017 02:39 PM, Marco Pirovano wrote:
>>> Hello,
>>>
>>> I've have installed ntopng 2.4.170208 - Community Edition from FreeBSD ports on
>>> a server running FreeBSD 11.0-RELEASE-p7.
>>> The network card is an Intel Ethernet 10 Gigabit Converged Network Adapter
>>> X520-sr1.
>>>
>>> I'm using port mirror to analyze a 10Gbps link.
>>>
>>> The problem is that when I select the mirror interfaces - ix0 - I get the
>>> message:
>>>
>>> No packet has been received yet on interface ix0.
>>>
>>> On the same server is running FastNetMon, a DDoS detection tool, that use the
>>> same interface to analyze the traffic using netmap as traffic capture.
>>> It's running fine.
>>>
>>> If I run:
>>>
>>> # systat -ifstat 1
>>>
>>> I see the traffic on ix0 interfaces:
>>>
>>> /0 /1 /2 /3 /4 /5 /6 /7 /8 /9 /10
>>> Load Average |||||||||||||||||||
>>>
>>> Interface Traffic Peak Total
>>> lo0 in 368.304 KB/s 412.514 KB/s 127.259 GB
>>> out 368.304 KB/s 412.514 KB/s 127.259 GB
>>>
>>> bce0 in 14.956 KB/s 110.841 KB/s 2.656 GB
>>> out 87.403 KB/s 3.438 MB/s 30.069 GB
>>>
>>> ix0 in 287.174 MB/s 556.409 MB/s 39.230 TB
>>> out 0.000 KB/s 0.000 KB/s 0.000 KB
>>>
>>> How could be the problem ?
>>> NTOPNG and FastNetMon can't run on the same server ?
>>>
>>> Thanks a lot.
>>>
>>> Ciao
>>> Marco
>>>
>>
>> _______________________________________________
>> Ntop mailing list
>> Ntop@listgateway.unipi.it
>> http://listgateway.unipi.it/mailman/listinfo/ntop
>
> --
> Marco Pirovano
> Infrastrutture e Tecnologie
> Information and Communication Technology
> Universita' Bocconi
> via Gobbi, 5 - 20136 Milano
> Tel. +39 02 5836.3173 Fax. +39 02 5836.3160
>
> Windows makes noise, Linux plays music,
> but BSD Rocks!
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop

--
Marco Pirovano
Infrastrutture e Tecnologie
Information and Communication Technology
Universita' Bocconi
via Gobbi, 5 - 20136 Milano
Tel. +39 02 5836.3173 Fax. +39 02 5836.3160

Windows makes noise, Linux plays music,
but BSD Rocks!
_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop

Re: NTOPNG FreeBSD 10G interface [ In reply to ]

deri at ntop

Feb 13, 2017, 1:52 AM

Post #5 of 5 (798 views)

Permalink

Marco
this is because netmap (used by FastNetMon) disconnects the network
interface from the kernel.

You need to setup (if exists on netmap) an app like
https://github.com/ntop/PF_RING/blob/dev/userland/examples_zc/zbalance_ipc.c

Any chance to move to Linux?

Regards Luca

On 02/10/2017 11:46 AM, Marco Pirovano wrote:
> Luca,
>
> if I stop FastNetMon NTOPNG works fine.
>
> They can't run together on the same server :-(
>
> Ciao
> Marco
>
> ----- Il 10-feb-17, alle 10:20, Marco Pirovano marco.pirovano@unibocconi.it ha scritto:
>
>> Luca,
>>
>> no traffic for tcpdump -i ix0
>>
>> Marco
>>
>> ----- Il 10-feb-17, alle 10:10, Luca Deri deri@ntop.org ha scritto:
>>
>>> Marco
>>> what is you do tcpdump -i ix0? Do you see any traffic?
>>>
>>> Luca
>>>
>>> On 02/09/2017 02:39 PM, Marco Pirovano wrote:
>>>> Hello,
>>>>
>>>> I've have installed ntopng 2.4.170208 - Community Edition from FreeBSD ports on
>>>> a server running FreeBSD 11.0-RELEASE-p7.
>>>> The network card is an Intel Ethernet 10 Gigabit Converged Network Adapter
>>>> X520-sr1.
>>>>
>>>> I'm using port mirror to analyze a 10Gbps link.
>>>>
>>>> The problem is that when I select the mirror interfaces - ix0 - I get the
>>>> message:
>>>>
>>>> No packet has been received yet on interface ix0.
>>>>
>>>> On the same server is running FastNetMon, a DDoS detection tool, that use the
>>>> same interface to analyze the traffic using netmap as traffic capture.
>>>> It's running fine.
>>>>
>>>> If I run:
>>>>
>>>> # systat -ifstat 1
>>>>
>>>> I see the traffic on ix0 interfaces:
>>>>
>>>> /0 /1 /2 /3 /4 /5 /6 /7 /8 /9 /10
>>>> Load Average |||||||||||||||||||
>>>>
>>>> Interface Traffic Peak Total
>>>> lo0 in 368.304 KB/s 412.514 KB/s 127.259 GB
>>>> out 368.304 KB/s 412.514 KB/s 127.259 GB
>>>>
>>>> bce0 in 14.956 KB/s 110.841 KB/s 2.656 GB
>>>> out 87.403 KB/s 3.438 MB/s 30.069 GB
>>>>
>>>> ix0 in 287.174 MB/s 556.409 MB/s 39.230 TB
>>>> out 0.000 KB/s 0.000 KB/s 0.000 KB
>>>>
>>>> How could be the problem ?
>>>> NTOPNG and FastNetMon can't run on the same server ?
>>>>
>>>> Thanks a lot.
>>>>
>>>> Ciao
>>>> Marco
>>>>
>>> _______________________________________________
>>> Ntop mailing list
>>> Ntop@listgateway.unipi.it
>>> http://listgateway.unipi.it/mailman/listinfo/ntop
>> --
>> Marco Pirovano
>> Infrastrutture e Tecnologie
>> Information and Communication Technology
>> Universita' Bocconi
>> via Gobbi, 5 - 20136 Milano
>> Tel. +39 02 5836.3173 Fax. +39 02 5836.3160
>>
>> Windows makes noise, Linux plays music,
>> but BSD Rocks!
>> _______________________________________________
>> Ntop mailing list
>> Ntop@listgateway.unipi.it
>> http://listgateway.unipi.it/mailman/listinfo/ntop

_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop