Mailing List Archive: nProbe dropping packets

nProbe dropping packets

Sep 17, 2019, 11:05 PM

Post #1 of 5 (1085 views)

Hello Everyone,

My nprobe is dropping packets. I am parsing GTPv1 and GTPv2 traffic and it
is dropping packets.

Packet Drops:

Duration: 0:00:03:14:028
Bytes: 716492747
Packets: 1578377
Dropped: 757155

Duration: 0:00:03:16:029
Bytes: 721327235
Packets: 1589106
Dropped: 787448

Duration: 0:00:03:17:029
Bytes: 724705319
Packets: 1596837
Dropped: 802482

Duration: 0:00:04:32:040
Bytes: 895463735
Packets: 1973912
Dropped: 1988866

Verbose Logging:

Sep 18 01:45:14 gtp-parser nprobe[2011]: 18/Sep/2019 01:45:14
[nprobe.c:3330] Average traffic: [4.16 K pps][All Traffic 14.68 Mb/sec][IP
Traffic 12.35 Mb/sec][ratio 0.85]
Sep 18 01:45:14 gtp-parser nprobe[2011]: 18/Sep/2019 01:45:14
[nprobe.c:3338] Current traffic: [4.18 K pps][14.69 Mb/sec]

Sep 18 11:57:42 gtp-parser nprobe[2100]: 18/Sep/2019 11:57:42
[nprobe.c:3330] Average traffic: [5.41 K pps][All Traffic 17.59 Mb/sec][IP
Traffic 14.54 Mb/sec][ratio 0.83]

Sep 18 11:57:42 gtp-parser nprobe[2100]: 18/Sep/2019 11:57:42
[nprobe.c:3338] Current traffic: [5.49 K pps][17.85 Mb/sec]

My nprobe configuration file:

-g=/var/run/nprobe.pid
-G=
-i=anic:0
-n=none

-T=%FIRST_SWITCHED \ %LAST_SWITCHED \ %FLOW_START_MILLISECONDS \
%FLOW_END_MILLISECONDS \ %IN_PKTS \ %IN_BYTES \ %IPV4_SRC_ADDR \
%IPV4_DST_ADDR \ %INPUT_SNMP \ %OUTPUT_SNMP \ %L4_SRC_PORT \ %L4_DST_PORT \
%TCP_FLAGS \ %PROTOCOL \ %SRC_TOS \ %BIFLOW_DIRECTION \ %L7_PROTO \
%APPLICATION_ID \ %UPSTREAM_TUNNEL_ID \ %DOWNSTREAM_TUNNEL_ID \
%UNTUNNELED_IPV4_SRC_ADDR \ %UNTUNNELED_IPV4_DST_ADDR \
%UNTUNNELED_PROTOCOL \ %GTPV1_REQ_MSG_TYPE \ %GTPV1_RSP_MSG_TYPE \
%GTPV1_C2S_TEID_DATA \ %GTPV1_C2S_TEID_CTRL \ %GTPV1_S2C_TEID_DATA \
%GTPV1_S2C_TEID_CTRL \ %GTPV1_END_USER_IP \ %GTPV1_END_USER_IMSI \
%GTPV1_END_USER_MSISDN \ %GTPV1_END_USER_IMEI \ %GTPV1_APN_NAME \
%GTPV1_RAI_MCC \ %GTPV1_RAI_MNC \ %GTPV1_RAI_LAC \ %GTPV1_RAI_RAC \
%GTPV1_ULI_MCC \ %GTPV1_ULI_MNC \ %GTPV1_ULI_CELL_LAC \ %GTPV1_ULI_CELL_CI
\ %GTPV1_ULI_SAC \ %GTPV1_RESPONSE_CAUSE \ %GTPV1_RAT_TYPE \
%GTPV2_REQ_MSG_TYPE \ %GTPV2_RSP_MSG_TYPE \ %GTPV2_S5_S8_GTPC_TEID \
%GTPV2_C2S_S5_S8_GTPU_TEID \ %GTPV2_S2C_S5_S8_GTPU_TEID \
%GTPV2_C2S_S5_S8_GTPU_IP \ %GTPV2_S2C_S5_S8_GTPU_IP \ %GTPV2_END_USER_IMSI
\ %GTPV2_END_USER_MSISDN \ %GTPV2_APN_NAME \ %GTPV2_ULI_MCC \
%GTPV2_ULI_MNC \ %GTPV2_ULI_CELL_TAC \ %GTPV2_ULI_CELL_ID \
%GTPV2_RESPONSE_CAUSE \ %GTPV2_RAT_TYPE \ %GTPV2_PDN_IP \
%GTPV2_END_USER_IMEI

--cpu-affinity=1,2,3,4,5
--export-thread-affinity=5
--biflows-export-policy=0
--tcp=192.168.115.205:5510
--drop-flow-no-plugin
--capture-direction=1
--tunnel
--max-num-untunnels
--account-imsi-traffic

nProbe version:
v.8.6.190909 (r6339)

OS:
Debian GNU/Linux 9 (stretch)

Hardware Settings:
Intel(R) Xeon(R) Bronze 3104 CPU @ 1.70GHz
Architecture: x86_64
CPU(s): 6
MemTotal: 23268540 kB
MemFree: 20080372 kB
MemAvailable: 19934104 kB
Buffers: 26204 kB
Cached: 76816 kB
total used free shared buff/cache available
Mem: 22G 2.9G 19G 8.9M 140M 19G
Swap: 93G 0B 93G

NIC Cards:
ANIC-40KU (Accolade)

Same issue with Intel NIC card:

ethtool -i enp23s0f1

driver: i40e

version: 1.6.16-k

firmware-version: 6.01 0x800036de 1.1861.0

expansion-rom-version:

bus-info: 0000:17:00.1

supports-statistics: yes

supports-test: yes

supports-eeprom-access: yes

supports-register-dump: yes

supports-priv-flags: yes

Thanks and Regards,
-=Srijan Nandi

nProbe dropping packets [ In reply to ]

srijan.nandi at gmail

Sep 17, 2019, 11:05 PM

Post #2 of 5 (1085 views)

Permalink

Re: nProbe dropping packets [ In reply to ]

cardigliano at ntop

Sep 18, 2019, 12:22 AM

Post #3 of 5 (1083 views)

Permalink

Hi Srijan
please keep posting in a single place (https://github.com/ntop/nProbe/issues/379 <https://github.com/ntop/nProbe/issues/379>)

Thank you
Alfredo

> On 18 Sep 2019, at 08:05, Srijan Nandi <srijan.nandi@gmail.com> wrote:
>
> Hello Everyone,
>
> My nprobe is dropping packets. I am parsing GTPv1 and GTPv2 traffic and it is dropping packets.
>
> Packet Drops:
>
> Duration: 0:00:03:14:028
> Bytes: 716492747
> Packets: 1578377
> Dropped: 757155
>
> Duration: 0:00:03:16:029
> Bytes: 721327235
> Packets: 1589106
> Dropped: 787448
>
> Duration: 0:00:03:17:029
> Bytes: 724705319
> Packets: 1596837
> Dropped: 802482
>
> Duration: 0:00:04:32:040
> Bytes: 895463735
> Packets: 1973912
> Dropped: 1988866
>
> Verbose Logging:
>
> Sep 18 01:45:14 gtp-parser nprobe[2011]: 18/Sep/2019 01:45:14 [nprobe.c:3330] Average traffic: [4.16 K pps][All Traffic 14.68 Mb/sec][IP Traffic 12.35 Mb/sec][ratio 0.85]
> Sep 18 01:45:14 gtp-parser nprobe[2011]: 18/Sep/2019 01:45:14 [nprobe.c:3338] Current traffic: [4.18 K pps][14.69 Mb/sec]
>
> Sep 18 11:57:42 gtp-parser nprobe[2100]: 18/Sep/2019 11:57:42 [nprobe.c:3330] Average traffic: [5.41 K pps][All Traffic 17.59 Mb/sec][IP Traffic 14.54 Mb/sec][ratio 0.83]
>
> Sep 18 11:57:42 gtp-parser nprobe[2100]: 18/Sep/2019 11:57:42 [nprobe.c:3338] Current traffic: [5.49 K pps][17.85 Mb/sec]
>
> My nprobe configuration file:
>
> -g=/var/run/nprobe.pid
> -G=
> -i=anic:0
> -n=none
>
> -T=%FIRST_SWITCHED \ %LAST_SWITCHED \ %FLOW_START_MILLISECONDS \ %FLOW_END_MILLISECONDS \ %IN_PKTS \ %IN_BYTES \ %IPV4_SRC_ADDR \ %IPV4_DST_ADDR \ %INPUT_SNMP \ %OUTPUT_SNMP \ %L4_SRC_PORT \ %L4_DST_PORT \ %TCP_FLAGS \ %PROTOCOL \ %SRC_TOS \ %BIFLOW_DIRECTION \ %L7_PROTO \ %APPLICATION_ID \ %UPSTREAM_TUNNEL_ID \ %DOWNSTREAM_TUNNEL_ID \ %UNTUNNELED_IPV4_SRC_ADDR \ %UNTUNNELED_IPV4_DST_ADDR \ %UNTUNNELED_PROTOCOL \ %GTPV1_REQ_MSG_TYPE \ %GTPV1_RSP_MSG_TYPE \ %GTPV1_C2S_TEID_DATA \ %GTPV1_C2S_TEID_CTRL \ %GTPV1_S2C_TEID_DATA \ %GTPV1_S2C_TEID_CTRL \ %GTPV1_END_USER_IP \ %GTPV1_END_USER_IMSI \ %GTPV1_END_USER_MSISDN \ %GTPV1_END_USER_IMEI \ %GTPV1_APN_NAME \ %GTPV1_RAI_MCC \ %GTPV1_RAI_MNC \ %GTPV1_RAI_LAC \ %GTPV1_RAI_RAC \ %GTPV1_ULI_MCC \ %GTPV1_ULI_MNC \ %GTPV1_ULI_CELL_LAC \ %GTPV1_ULI_CELL_CI \ %GTPV1_ULI_SAC \ %GTPV1_RESPONSE_CAUSE \ %GTPV1_RAT_TYPE \ %GTPV2_REQ_MSG_TYPE \ %GTPV2_RSP_MSG_TYPE \ %GTPV2_S5_S8_GTPC_TEID \ %GTPV2_C2S_S5_S8_GTPU_TEID \ %GTPV2_S2C_S5_S8_GTPU_TEID \ %GTPV2_C2S_S5_S8_GTPU_IP \ %GTPV2_S2C_S5_S8_GTPU_IP \ %GTPV2_END_USER_IMSI \ %GTPV2_END_USER_MSISDN \ %GTPV2_APN_NAME \ %GTPV2_ULI_MCC \ %GTPV2_ULI_MNC \ %GTPV2_ULI_CELL_TAC \ %GTPV2_ULI_CELL_ID \ %GTPV2_RESPONSE_CAUSE \ %GTPV2_RAT_TYPE \ %GTPV2_PDN_IP \ %GTPV2_END_USER_IMEI
>
> --cpu-affinity=1,2,3,4,5
> --export-thread-affinity=5
> --biflows-export-policy=0
> --tcp=192.168.115.205:5510 <http://192.168.115.205:5510/>
> --drop-flow-no-plugin
> --capture-direction=1
> --tunnel
> --max-num-untunnels
> --account-imsi-traffic
>
> nProbe version:
> v.8.6.190909 (r6339)
>
> OS:
> Debian GNU/Linux 9 (stretch)
>
> Hardware Settings:
> Intel(R) Xeon(R) Bronze 3104 CPU @ 1.70GHz
> Architecture: x86_64
> CPU(s): 6
> MemTotal: 23268540 kB
> MemFree: 20080372 kB
> MemAvailable: 19934104 kB
> Buffers: 26204 kB
> Cached: 76816 kB
> total used free shared buff/cache available
> Mem: 22G 2.9G 19G 8.9M 140M 19G
> Swap: 93G 0B 93G
>
> NIC Cards:
> ANIC-40KU (Accolade)
>
> Same issue with Intel NIC card:
>
> ethtool -i enp23s0f1
>
> driver: i40e
>
> version: 1.6.16-k
>
> firmware-version: 6.01 0x800036de 1.1861.0
>
> expansion-rom-version:
>
> bus-info: 0000:17:00.1
>
> supports-statistics: yes
>
> supports-test: yes
>
> supports-eeprom-access: yes
>
> supports-register-dump: yes
>
> supports-priv-flags: yes
>
> Thanks and Regards,
> -=Srijan Nandi
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop

Re: nProbe dropping packets [ In reply to ]

cardigliano at ntop

Sep 18, 2019, 12:22 AM

Post #4 of 5 (1083 views)

Permalink

Re: nProbe dropping packets [ In reply to ]

srijan.nandi at gmail

Sep 18, 2019, 12:50 AM

Post #5 of 5 (1083 views)

Permalink

Sure, Alfredo.

I thought it was my mistake to open in github. That's the reason I wrote to
the mailing list. I have updated the ticket on github.

Thanks and Regards,
-=Srijan Nandi

On Wed, 18 Sep 2019 at 12:52, Alfredo Cardigliano <cardigliano@ntop.org>
wrote:

> Hi Srijan
> please keep posting in a single place (
> https://github.com/ntop/nProbe/issues/379)
>
> Thank you
> Alfredo
>
> On 18 Sep 2019, at 08:05, Srijan Nandi <srijan.nandi@gmail.com> wrote:
>
> Hello Everyone,
>
> My nprobe is dropping packets. I am parsing GTPv1 and GTPv2 traffic and it
> is dropping packets.
>
> Packet Drops:
>
> Duration: 0:00:03:14:028
> Bytes: 716492747
> Packets: 1578377
> Dropped: 757155
>
> Duration: 0:00:03:16:029
> Bytes: 721327235
> Packets: 1589106
> Dropped: 787448
>
> Duration: 0:00:03:17:029
> Bytes: 724705319
> Packets: 1596837
> Dropped: 802482
>
> Duration: 0:00:04:32:040
> Bytes: 895463735
> Packets: 1973912
> Dropped: 1988866
>
> Verbose Logging:
>
> Sep 18 01:45:14 gtp-parser nprobe[2011]: 18/Sep/2019 01:45:14
> [nprobe.c:3330] Average traffic: [4.16 K pps][All Traffic 14.68 Mb/sec][IP
> Traffic 12.35 Mb/sec][ratio 0.85]
> Sep 18 01:45:14 gtp-parser nprobe[2011]: 18/Sep/2019 01:45:14
> [nprobe.c:3338] Current traffic: [4.18 K pps][14.69 Mb/sec]
>
> Sep 18 11:57:42 gtp-parser nprobe[2100]: 18/Sep/2019 11:57:42
> [nprobe.c:3330] Average traffic: [5.41 K pps][All Traffic 17.59 Mb/sec][IP
> Traffic 14.54 Mb/sec][ratio 0.83]
>
> Sep 18 11:57:42 gtp-parser nprobe[2100]: 18/Sep/2019 11:57:42
> [nprobe.c:3338] Current traffic: [5.49 K pps][17.85 Mb/sec]
>
> My nprobe configuration file:
>
> -g=/var/run/nprobe.pid
> -G=
> -i=anic:0
> -n=none
>
> -T=%FIRST_SWITCHED \ %LAST_SWITCHED \ %FLOW_START_MILLISECONDS \
> %FLOW_END_MILLISECONDS \ %IN_PKTS \ %IN_BYTES \ %IPV4_SRC_ADDR \
> %IPV4_DST_ADDR \ %INPUT_SNMP \ %OUTPUT_SNMP \ %L4_SRC_PORT \ %L4_DST_PORT \
> %TCP_FLAGS \ %PROTOCOL \ %SRC_TOS \ %BIFLOW_DIRECTION \ %L7_PROTO \
> %APPLICATION_ID \ %UPSTREAM_TUNNEL_ID \ %DOWNSTREAM_TUNNEL_ID \
> %UNTUNNELED_IPV4_SRC_ADDR \ %UNTUNNELED_IPV4_DST_ADDR \
> %UNTUNNELED_PROTOCOL \ %GTPV1_REQ_MSG_TYPE \ %GTPV1_RSP_MSG_TYPE \
> %GTPV1_C2S_TEID_DATA \ %GTPV1_C2S_TEID_CTRL \ %GTPV1_S2C_TEID_DATA \
> %GTPV1_S2C_TEID_CTRL \ %GTPV1_END_USER_IP \ %GTPV1_END_USER_IMSI \
> %GTPV1_END_USER_MSISDN \ %GTPV1_END_USER_IMEI \ %GTPV1_APN_NAME \
> %GTPV1_RAI_MCC \ %GTPV1_RAI_MNC \ %GTPV1_RAI_LAC \ %GTPV1_RAI_RAC \
> %GTPV1_ULI_MCC \ %GTPV1_ULI_MNC \ %GTPV1_ULI_CELL_LAC \ %GTPV1_ULI_CELL_CI
> \ %GTPV1_ULI_SAC \ %GTPV1_RESPONSE_CAUSE \ %GTPV1_RAT_TYPE \
> %GTPV2_REQ_MSG_TYPE \ %GTPV2_RSP_MSG_TYPE \ %GTPV2_S5_S8_GTPC_TEID \
> %GTPV2_C2S_S5_S8_GTPU_TEID \ %GTPV2_S2C_S5_S8_GTPU_TEID \
> %GTPV2_C2S_S5_S8_GTPU_IP \ %GTPV2_S2C_S5_S8_GTPU_IP \ %GTPV2_END_USER_IMSI
> \ %GTPV2_END_USER_MSISDN \ %GTPV2_APN_NAME \ %GTPV2_ULI_MCC \
> %GTPV2_ULI_MNC \ %GTPV2_ULI_CELL_TAC \ %GTPV2_ULI_CELL_ID \
> %GTPV2_RESPONSE_CAUSE \ %GTPV2_RAT_TYPE \ %GTPV2_PDN_IP \
> %GTPV2_END_USER_IMEI
>
> --cpu-affinity=1,2,3,4,5
> --export-thread-affinity=5
> --biflows-export-policy=0
> --tcp=192.168.115.205:5510
> --drop-flow-no-plugin
> --capture-direction=1
> --tunnel
> --max-num-untunnels
> --account-imsi-traffic
>
> nProbe version:
> v.8.6.190909 (r6339)
>
> OS:
> Debian GNU/Linux 9 (stretch)
>
> Hardware Settings:
> Intel(R) Xeon(R) Bronze 3104 CPU @ 1.70GHz
> Architecture: x86_64
> CPU(s): 6
> MemTotal: 23268540 kB
> MemFree: 20080372 kB
> MemAvailable: 19934104 kB
> Buffers: 26204 kB
> Cached: 76816 kB
> total used free shared buff/cache available
> Mem: 22G 2.9G 19G 8.9M 140M 19G
> Swap: 93G 0B 93G
>
> NIC Cards:
> ANIC-40KU (Accolade)
>
> Same issue with Intel NIC card:
>
> ethtool -i enp23s0f1
>
> driver: i40e
>
> version: 1.6.16-k
>
> firmware-version: 6.01 0x800036de 1.1861.0
>
> expansion-rom-version:
>
> bus-info: 0000:17:00.1
>
> supports-statistics: yes
>
> supports-test: yes
>
> supports-eeprom-access: yes
>
> supports-register-dump: yes
>
> supports-priv-flags: yes
> Thanks and Regards,
> -=Srijan Nandi
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop
>
>
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop

--
-=Srijan Nandi