Hello Everyone,
My nprobe is dropping packets. I am parsing GTPv1 and GTPv2 traffic and it
is dropping packets.
Packet Drops:
Duration: 0:00:03:14:028
Bytes: 716492747
Packets: 1578377
Dropped: 757155
Duration: 0:00:03:16:029
Bytes: 721327235
Packets: 1589106
Dropped: 787448
Duration: 0:00:03:17:029
Bytes: 724705319
Packets: 1596837
Dropped: 802482
Duration: 0:00:04:32:040
Bytes: 895463735
Packets: 1973912
Dropped: 1988866
Verbose Logging:
Sep 18 01:45:14 gtp-parser nprobe[2011]: 18/Sep/2019 01:45:14
[nprobe.c:3330] Average traffic: [4.16 K pps][All Traffic 14.68 Mb/sec][IP
Traffic 12.35 Mb/sec][ratio 0.85]
Sep 18 01:45:14 gtp-parser nprobe[2011]: 18/Sep/2019 01:45:14
[nprobe.c:3338] Current traffic: [4.18 K pps][14.69 Mb/sec]
Sep 18 11:57:42 gtp-parser nprobe[2100]: 18/Sep/2019 11:57:42
[nprobe.c:3330] Average traffic: [5.41 K pps][All Traffic 17.59 Mb/sec][IP
Traffic 14.54 Mb/sec][ratio 0.83]
Sep 18 11:57:42 gtp-parser nprobe[2100]: 18/Sep/2019 11:57:42
[nprobe.c:3338] Current traffic: [5.49 K pps][17.85 Mb/sec]
My nprobe configuration file:
-g=/var/run/nprobe.pid
-G=
-i=anic:0
-n=none
-T=%FIRST_SWITCHED \ %LAST_SWITCHED \ %FLOW_START_MILLISECONDS \
%FLOW_END_MILLISECONDS \ %IN_PKTS \ %IN_BYTES \ %IPV4_SRC_ADDR \
%IPV4_DST_ADDR \ %INPUT_SNMP \ %OUTPUT_SNMP \ %L4_SRC_PORT \ %L4_DST_PORT \
%TCP_FLAGS \ %PROTOCOL \ %SRC_TOS \ %BIFLOW_DIRECTION \ %L7_PROTO \
%APPLICATION_ID \ %UPSTREAM_TUNNEL_ID \ %DOWNSTREAM_TUNNEL_ID \
%UNTUNNELED_IPV4_SRC_ADDR \ %UNTUNNELED_IPV4_DST_ADDR \
%UNTUNNELED_PROTOCOL \ %GTPV1_REQ_MSG_TYPE \ %GTPV1_RSP_MSG_TYPE \
%GTPV1_C2S_TEID_DATA \ %GTPV1_C2S_TEID_CTRL \ %GTPV1_S2C_TEID_DATA \
%GTPV1_S2C_TEID_CTRL \ %GTPV1_END_USER_IP \ %GTPV1_END_USER_IMSI \
%GTPV1_END_USER_MSISDN \ %GTPV1_END_USER_IMEI \ %GTPV1_APN_NAME \
%GTPV1_RAI_MCC \ %GTPV1_RAI_MNC \ %GTPV1_RAI_LAC \ %GTPV1_RAI_RAC \
%GTPV1_ULI_MCC \ %GTPV1_ULI_MNC \ %GTPV1_ULI_CELL_LAC \ %GTPV1_ULI_CELL_CI
\ %GTPV1_ULI_SAC \ %GTPV1_RESPONSE_CAUSE \ %GTPV1_RAT_TYPE \
%GTPV2_REQ_MSG_TYPE \ %GTPV2_RSP_MSG_TYPE \ %GTPV2_S5_S8_GTPC_TEID \
%GTPV2_C2S_S5_S8_GTPU_TEID \ %GTPV2_S2C_S5_S8_GTPU_TEID \
%GTPV2_C2S_S5_S8_GTPU_IP \ %GTPV2_S2C_S5_S8_GTPU_IP \ %GTPV2_END_USER_IMSI
\ %GTPV2_END_USER_MSISDN \ %GTPV2_APN_NAME \ %GTPV2_ULI_MCC \
%GTPV2_ULI_MNC \ %GTPV2_ULI_CELL_TAC \ %GTPV2_ULI_CELL_ID \
%GTPV2_RESPONSE_CAUSE \ %GTPV2_RAT_TYPE \ %GTPV2_PDN_IP \
%GTPV2_END_USER_IMEI
--cpu-affinity=1,2,3,4,5
--export-thread-affinity=5
--biflows-export-policy=0
--tcp=192.168.115.205:5510
--drop-flow-no-plugin
--capture-direction=1
--tunnel
--max-num-untunnels
--account-imsi-traffic
nProbe version:
v.8.6.190909 (r6339)
OS:
Debian GNU/Linux 9 (stretch)
Hardware Settings:
Intel(R) Xeon(R) Bronze 3104 CPU @ 1.70GHz
Architecture: x86_64
CPU(s): 6
MemTotal: 23268540 kB
MemFree: 20080372 kB
MemAvailable: 19934104 kB
Buffers: 26204 kB
Cached: 76816 kB
total used free shared buff/cache available
Mem: 22G 2.9G 19G 8.9M 140M 19G
Swap: 93G 0B 93G
NIC Cards:
ANIC-40KU (Accolade)
Same issue with Intel NIC card:
ethtool -i enp23s0f1
driver: i40e
version: 1.6.16-k
firmware-version: 6.01 0x800036de 1.1861.0
expansion-rom-version:
bus-info: 0000:17:00.1
supports-statistics: yes
supports-test: yes
supports-eeprom-access: yes
supports-register-dump: yes
supports-priv-flags: yes
Thanks and Regards,
-=Srijan Nandi
My nprobe is dropping packets. I am parsing GTPv1 and GTPv2 traffic and it
is dropping packets.
Packet Drops:
Duration: 0:00:03:14:028
Bytes: 716492747
Packets: 1578377
Dropped: 757155
Duration: 0:00:03:16:029
Bytes: 721327235
Packets: 1589106
Dropped: 787448
Duration: 0:00:03:17:029
Bytes: 724705319
Packets: 1596837
Dropped: 802482
Duration: 0:00:04:32:040
Bytes: 895463735
Packets: 1973912
Dropped: 1988866
Verbose Logging:
Sep 18 01:45:14 gtp-parser nprobe[2011]: 18/Sep/2019 01:45:14
[nprobe.c:3330] Average traffic: [4.16 K pps][All Traffic 14.68 Mb/sec][IP
Traffic 12.35 Mb/sec][ratio 0.85]
Sep 18 01:45:14 gtp-parser nprobe[2011]: 18/Sep/2019 01:45:14
[nprobe.c:3338] Current traffic: [4.18 K pps][14.69 Mb/sec]
Sep 18 11:57:42 gtp-parser nprobe[2100]: 18/Sep/2019 11:57:42
[nprobe.c:3330] Average traffic: [5.41 K pps][All Traffic 17.59 Mb/sec][IP
Traffic 14.54 Mb/sec][ratio 0.83]
Sep 18 11:57:42 gtp-parser nprobe[2100]: 18/Sep/2019 11:57:42
[nprobe.c:3338] Current traffic: [5.49 K pps][17.85 Mb/sec]
My nprobe configuration file:
-g=/var/run/nprobe.pid
-G=
-i=anic:0
-n=none
-T=%FIRST_SWITCHED \ %LAST_SWITCHED \ %FLOW_START_MILLISECONDS \
%FLOW_END_MILLISECONDS \ %IN_PKTS \ %IN_BYTES \ %IPV4_SRC_ADDR \
%IPV4_DST_ADDR \ %INPUT_SNMP \ %OUTPUT_SNMP \ %L4_SRC_PORT \ %L4_DST_PORT \
%TCP_FLAGS \ %PROTOCOL \ %SRC_TOS \ %BIFLOW_DIRECTION \ %L7_PROTO \
%APPLICATION_ID \ %UPSTREAM_TUNNEL_ID \ %DOWNSTREAM_TUNNEL_ID \
%UNTUNNELED_IPV4_SRC_ADDR \ %UNTUNNELED_IPV4_DST_ADDR \
%UNTUNNELED_PROTOCOL \ %GTPV1_REQ_MSG_TYPE \ %GTPV1_RSP_MSG_TYPE \
%GTPV1_C2S_TEID_DATA \ %GTPV1_C2S_TEID_CTRL \ %GTPV1_S2C_TEID_DATA \
%GTPV1_S2C_TEID_CTRL \ %GTPV1_END_USER_IP \ %GTPV1_END_USER_IMSI \
%GTPV1_END_USER_MSISDN \ %GTPV1_END_USER_IMEI \ %GTPV1_APN_NAME \
%GTPV1_RAI_MCC \ %GTPV1_RAI_MNC \ %GTPV1_RAI_LAC \ %GTPV1_RAI_RAC \
%GTPV1_ULI_MCC \ %GTPV1_ULI_MNC \ %GTPV1_ULI_CELL_LAC \ %GTPV1_ULI_CELL_CI
\ %GTPV1_ULI_SAC \ %GTPV1_RESPONSE_CAUSE \ %GTPV1_RAT_TYPE \
%GTPV2_REQ_MSG_TYPE \ %GTPV2_RSP_MSG_TYPE \ %GTPV2_S5_S8_GTPC_TEID \
%GTPV2_C2S_S5_S8_GTPU_TEID \ %GTPV2_S2C_S5_S8_GTPU_TEID \
%GTPV2_C2S_S5_S8_GTPU_IP \ %GTPV2_S2C_S5_S8_GTPU_IP \ %GTPV2_END_USER_IMSI
\ %GTPV2_END_USER_MSISDN \ %GTPV2_APN_NAME \ %GTPV2_ULI_MCC \
%GTPV2_ULI_MNC \ %GTPV2_ULI_CELL_TAC \ %GTPV2_ULI_CELL_ID \
%GTPV2_RESPONSE_CAUSE \ %GTPV2_RAT_TYPE \ %GTPV2_PDN_IP \
%GTPV2_END_USER_IMEI
--cpu-affinity=1,2,3,4,5
--export-thread-affinity=5
--biflows-export-policy=0
--tcp=192.168.115.205:5510
--drop-flow-no-plugin
--capture-direction=1
--tunnel
--max-num-untunnels
--account-imsi-traffic
nProbe version:
v.8.6.190909 (r6339)
OS:
Debian GNU/Linux 9 (stretch)
Hardware Settings:
Intel(R) Xeon(R) Bronze 3104 CPU @ 1.70GHz
Architecture: x86_64
CPU(s): 6
MemTotal: 23268540 kB
MemFree: 20080372 kB
MemAvailable: 19934104 kB
Buffers: 26204 kB
Cached: 76816 kB
total used free shared buff/cache available
Mem: 22G 2.9G 19G 8.9M 140M 19G
Swap: 93G 0B 93G
NIC Cards:
ANIC-40KU (Accolade)
Same issue with Intel NIC card:
ethtool -i enp23s0f1
driver: i40e
version: 1.6.16-k
firmware-version: 6.01 0x800036de 1.1861.0
expansion-rom-version:
bus-info: 0000:17:00.1
supports-statistics: yes
supports-test: yes
supports-eeprom-access: yes
supports-register-dump: yes
supports-priv-flags: yes
Thanks and Regards,
-=Srijan Nandi