[Bro] Netmap plugin issue

Dave Crawford bro at pingtrip.com
Fri Feb 10 20:24:51 PST 2017


> On Feb 10, 2017, at 10:07 PM, Deshmukh, Andy <deshmukh at slac.stanford.edu> wrote:
> 
> Yea!! I totally forgot about that... 
> But the packet_drop is very high! Is it cause of the tweaks in modprobe.d ? 

I have the same observations Andy.

{"ts":1486786393.408004,"interface":"netmap:eth6","packets_received":3816916,"packets_forwarded":2495606,"packets_dropped":1213100,"non_ip_packets":2014,"data_forward_rate_Mbps":93.6190,"data_drop_rate_Mbps":0.0000,"packet_forward_rate_kpps":29.4030,"packet_drop_rate_kpps":0.0000,"free_buffer_slots":100000}

Wouldn’t a 30% packet loss result in a high number of weird.log messages as well as a high capture_loss? Bro is reporting under 1% for that worker.

1486786916.930127       600.000012      MID_INT-9       21      120263  0.017462
1486786916.899102       600.000025      MID_INT-2       26      113792  0.022849
1486786916.913207       600.000046      MID_INT-5       17      114020  0.01491
1486786917.062056       600.000040      MID_INT-1       37      122988  0.030084
1486786916.899164       600.000046      MID_INT-6       20      117978  0.016952
1486786916.898184       600.000043      MID_INT-8       10      117535  0.008508
1486786916.899106       600.000023      MID_INT-10      31      135819  0.022824
1486786916.899611       600.000023      MID_INT-3       19      130912  0.014514
1486786916.902911       600.000014      MID_INT-7       24      144454  0.016614
1486786916.897984       600.000029      MID_INT-4       25      106400  0.023496

-Dave



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20170210/b2a5cb66/attachment.html 


More information about the Bro mailing list