Hi Simone,
these are the configurations used:
/etc/ntopng/ntopng.conf
#
-i="zc:ens2@0"
-i="zc:ens2@1"
-i="zc:ens2@2"
-i="zc:ens2@3"
-i="view:zc:ens2@0,zc:ens2@1,zc:ens2@3,zc:ens2@3"
#
-w=3000
#
-m=10.0.0.0/8,193.205.23.0/24
#
-n=1
#
-d=/var/lib/ntopng
#
-x=150000
#
-X=1000000
#
#--capture-direction 1
#
/etc/pf_ring/
pf_ring.conf
min_num_slots=65536
hugepages.conf
node=0 hugepagenumber=1024
interfaces.conf
MANAGEMENT_INTERFACES="enp2s0f0"
CAPTURE_INTERFACES="ens2"
zc/ixgbe/ixgbe.conf
RSS=4,4,4,4
cat /proc/net/pf_ring/dev/ens2/info
Name: ens2
Index: 8
Address: 90:E2:BA:E0:62:04
Polling Mode: NAPI/ZC
Type: Ethernet
Family: Intel ixgbe 82599
TX Queues: 4
RX Queues: 4
Num RX Slots: 32768
Num TX Slots: 32768
[root@ntopng ~]# pf_ringctl status
Drivers Loaded
pf_ring Loaded
root@ntopng ~]# pfcount -i zc:ens2@0
Using PF_RING v.7.4.0
Capturing from zc:ens2@0 [mac: 90:E2:BA:E0:62:04][if_index: 8][speed: 10000Mb/s]
# Device RX channels: 4
# Polling threads: 1
Dumping statistics on /proc/net/pf_ring/stats/26507-ens2.100
=========================
Absolute Stats: [56'087 pkts total][0 pkts dropped][0.0% dropped]
[56'087 pkts rcvd][34'330'999 bytes rcvd]
=========================
[root@ntopng ~]# pfcount -i zc:ens2@1
Using PF_RING v.7.4.0
Capturing from zc:ens2@1 [mac: 90:E2:BA:E0:62:04][if_index: 8][speed: 10000Mb/s]
# Device RX channels: 4
# Polling threads: 1
Dumping statistics on /proc/net/pf_ring/stats/26519-ens2.101
=========================
Absolute Stats: [31'149 pkts total][0 pkts dropped][0.0% dropped]
[31'149 pkts rcvd][13'806'852 bytes rcvd]
=========================
[root@ntopng ~]#
[root@ntopng ~]# pfcount -i zc:ens2@2
Using PF_RING v.7.4.0
Capturing from zc:ens2@2 [mac: 90:E2:BA:E0:62:04][if_index: 8][speed: 10000Mb/s]
# Device RX channels: 4
# Polling threads: 1
Dumping statistics on /proc/net/pf_ring/stats/26530-ens2.102
=========================
Absolute Stats: [26'905 pkts total][0 pkts dropped][0.0% dropped]
[26'905 pkts rcvd][14'088'572 bytes rcvd]
=========================
[root@ntopng ~]#
[root@ntopng ~]# pfcount -i zc:ens2@3
Using PF_RING v.7.4.0
Capturing from zc:ens2@3 [mac: 90:E2:BA:E0:62:04][if_index: 8][speed: 10000Mb/s]
# Device RX channels: 4
# Polling threads: 1
Dumping statistics on /proc/net/pf_ring/stats/26531-ens2.103
=========================
Absolute Stats: [26'484 pkts total][0 pkts dropped][0.0% dropped]
[26'484 pkts rcvd][16'016'959 bytes rcvd]
=========================
As you can see, from the CLI, there are no packets dropped,
but from the NTOPNG GUI I see, for the view:zc... interface:
Received Traffic 854.75 GB [1,669,799,657 Pkts] Dropped Packets 1,444,351,763 Pkts [ 46.38 % ]
Whats wring ?
Thanks a lot.
Marco
----- Il 7-feb-19, alle 9:15, Simone Mainardi mainardi@ntop.org ha scritto:
> Marco,
>
>> On 6 Feb 2019, at 13:16, Marco Pirovano <marco.pirovano@unibocconi.it> wrote:
>>
>> Hi Simone,
>>
>> I've configured ntopng to start with the 4 zc:ens2@[0-3], but I see lot of
>> dropped Packets, over 90%:
>>
>> Received Traffic 20.14 GB [48,789,336 Pkts] Dropped Packets 515,138,975 Pkts
>> [ 91.35 % ]
>
> Are you getting drops for any of the 4 interfaces configured? How many PPS each
> interface is getting, on average? Did you try with core pinning as suggested?
>
> Please, post the full configuration used.
>
>>
>> Also, the speed of the 4 zc:ens2 interfaces is 10 Gbit/s, but the speed of the
>> view:zc:ens2 interfaces is 1 Gbit/s
>>
>> Marco
>>
>> ----- Il 4-feb-19, alle 17:19, Simone Mainardi mainardi@ntop.org ha scritto:
>>
>>> Hi Marco,
>>>
>>> As you're using RSS with 4 queues, you are balancing the incoming traffic among
>>> 4 queues.
>>>
>>> In order to monitor every single queue in ntopng, you have to explicitly tell it
>>> to monitor these 4 queues.
>>>
>>> So you should do
>>>
>>> -i="zc:ens2@0"
>>> -i="zc:ens2@1"
>>> -i="zc:ens2@2"
>>> -i="zc:ens2@3"
>>>
>>> Your current -i=ens2 is defaulting to queue number 0 and isn't using the Zero
>>> Copy driver.
>>>
>>> The use of zc: will reduce/eliminate the drops. Note that you can also play with
>>> core affinity (see --core-affinity)
>>> to make sure ntopng pins the 4 capturing threads spawned to certain cores that
>>> you want.
>>>
>>> Finally, if you want to merge the 4 interfaces in a single view, you can add an
>>> extra
>>> -i="view:zc:ens2@0,zc:ens2@1,zc:ens2@2,zc:ens2@3"
>>>
>>> Don't worry, the view won't put extra pressure on the machine.
>>>
>>> Regards,
>>>
>>> Simone
>>>
>>>
>>>> On 4 Feb 2019, at 12:29, Marco Pirovano <marco.pirovano@unibocconi.it> wrote:
>>>>
>>>> Hello,
>>>>
>>>> we are using NTOPNG to monitor our 10G link to internet.
>>>> We are using an Arista switch in Tap Aggregation mode to send traffic to NTOPNG
>>>> server.
>>>>
>>>> The traffic is about 2Gbps and we see several dropped packets:
>>>>
>>>> Received Traffic 157.47 GB [292,586,873 Pkts] Dropped Packets 25,637,433 Pkts
>>>> [ 8.06 % ]
>>>>
>>>> I've configured PF_RING ZC, the interface is an Intel 82599, ixgbe driver.
>>>>
>>>> ixgbe.conf configuration: RSS=4,4,4,4
>>>>
>>>> pf_fing.conf configuration: min_num_slots=65536
>>>>
>>>> ntopng.conf configuratrion:
>>>>
>>>> #
>>>> -i=ens2
>>>> #
>>>> -w=3000
>>>> #
>>>> -m=10.0.0.0/8,193.205.23.0/24
>>>> #
>>>> -n=1
>>>> #
>>>> -d=/var/lib/ntopng
>>>> #
>>>> -x=150000
>>>> #
>>>> -X=1000000
>>>> #
>>>>
>>>>
>>>> What do I need to setup correctly to see less dropped packets ?
>>>>
>>>> Thank you very much.
>>>> Marco
>>>>
>>>> --
>>>> Marco Pirovano
>>>> Security & Network Competence Centre
>>>> ICT - Universita' Bocconi
>>>> via Gobbi, 5 - 20136 Milano
>>>> Tel. +39 02 5836.3173
>>>> _______________________________________________
>>>> Ntop mailing list
>>>> Ntop@listgateway.unipi.it
>>>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>>
>>> _______________________________________________
>>> Ntop mailing list
>>> Ntop@listgateway.unipi.it
>>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>
>> --
>> Marco Pirovano
>> Security & Network Competence Centre
>> ICT - Universita' Bocconi
>> via Gobbi, 5 - 20136 Milano
>> Tel. +39 02 5836.3173
>> _______________________________________________
>> Ntop mailing list
>> Ntop@listgateway.unipi.it
>> http://listgateway.unipi.it/mailman/listinfo/ntop
>
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop
--
Marco Pirovano
Security & Network Competence Centre
ICT - Universita' Bocconi
via Gobbi, 5 - 20136 Milano
Tel. +39 02 5836.3173
_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop