[Bro] Netmap plugin issue

[Deshmukh, Andy]

Yea!! I totally forgot about that... 
But the packet_drop is very high! Is it cause of the tweaks in modprobe.d ? 

Feb 10 19:04:59 sec-bro04 lb: {"ts":1486782299.253931,"input_interface":"netmap:em1","output_interface":"netmap:broem1{0/xT at 1","packets_forwarded":66870,"packets_dropped":112000,"data_forward_rate_Mbps":9.5147,"data_drop_rate_Mbps":0.0000,"packet_forward_rate_kpps":0.9570,"packet_drop_rate_kpps":0.0000,"overflow_queue_size":0}
Feb 10 19:04:59 sec-bro04 lb: {"ts":1486782299.253931,"input_interface":"netmap:em1","output_interface":"netmap:broem1{1/xT at 1","packets_forwarded":56280,"packets_dropped":90700,"data_forward_rate_Mbps":11.9930,"data_drop_rate_Mbps":0.0000,"packet_forward_rate_kpps":1.5820,"packet_drop_rate_kpps":0.0000,"overflow_queue_size":0}
Feb 10 19:04:59 sec-bro04 lb: {"ts":1486782299.253931,"input_interface":"netmap:em1","output_interface":"netmap:broem1{2/xT at 1","packets_forwarded":51795,"packets_dropped":83500,"data_forward_rate_Mbps":10.2431,"data_drop_rate_Mbps":0.0000,"packet_forward_rate_kpps":0.8180,"packet_drop_rate_kpps":0.0000,"overflow_queue_size":0}
Feb 10 19:04:59 sec-bro04 lb: {"ts":1486782299.253931,"input_interface":"netmap:em1","output_interface":"netmap:broem1{3/xT at 1","packets_forwarded":535398,"packets_dropped":924500,"data_forward_rate_Mbps":175.7472,"data_drop_rate_Mbps":0.0000,"packet_forward_rate_kpps":13.4440,"packet_drop_rate_kpps":0.0000,"overflow_queue_size":0}
Feb 10 19:04:59 sec-bro04 lb: {"ts":1486782299.253931,"input_interface":"netmap:em1","output_interface":"netmap:broem1{4/xT at 1","packets_forwarded":228411,"packets_dropped":370900,"data_forward_rate_Mbps":13.0369,"data_drop_rate_Mbps":0.0000,"packet_forward_rate_kpps":2.8260,"packet_drop_rate_kpps":0.0000,"overflow_queue_size":0}
Feb 10 19:04:59 sec-bro04 lb: {"ts":1486782299.253931,"interface":"netmap:em1","packets_received":2522287,"packets_forwarded":938754,"packets_dropped":1581600,"non_ip_packets":54442,"data_forward_rate_Mbps":220.5349,"data_drop_rate_Mbps":0.0000,"packet_forward_rate_kpps":19.6260,"packet_drop_rate_kpps":0.0000,"free_buffer_slots":1000}
Feb 10 19:04:59 sec-bro04 lb: {"ts":1486782299.255037,"input_interface":"netmap:em2","output_interface":"netmap:broem2{0/xT at 1","packets_forwarded":200176,"packets_dropped":297700,"data_forward_rate_Mbps":3.0338,"data_drop_rate_Mbps":0.0000,"packet_forward_rate_kpps":2.2230,"packet_drop_rate_kpps":0.0000,"overflow_queue_size":0}
Feb 10 19:04:59 sec-bro04 lb: {"ts":1486782299.255037,"input_interface":"netmap:em2","output_interface":"netmap:broem2{1/xT at 1","packets_forwarded":18104,"packets_dropped":46000,"data_forward_rate_Mbps":0.1089,"data_drop_rate_Mbps":0.0000,"packet_forward_rate_kpps":0.0960,"packet_drop_rate_kpps":0.0000,"overflow_queue_size":0}
Feb 10 19:04:59 sec-bro04 lb: {"ts":1486782299.255037,"input_interface":"netmap:em2","output_interface":"netmap:broem2{2/xT at 1","packets_forwarded":18740,"packets_dropped":20400,"data_forward_rate_Mbps":0.5375,"data_drop_rate_Mbps":0.0000,"packet_forward_rate_kpps":0.4710,"packet_drop_rate_kpps":0.0000,"overflow_queue_size":0}
Feb 10 19:04:59 sec-bro04 lb: {"ts":1486782299.255037,"input_interface":"netmap:em2","output_interface":"netmap:broem2{3/xT at 1","packets_forwarded":26775,"packets_dropped":31500,"data_forward_rate_Mbps":0.0908,"data_drop_rate_Mbps":0.0000,"packet_forward_rate_kpps":0.0700,"packet_drop_rate_kpps":0.0000,"overflow_queue_size":0}
Feb 10 19:04:59 sec-bro04 lb: {"ts":1486782299.255037,"input_interface":"netmap:em2","output_interface":"netmap:broem2{4/xT at 1","packets_forwarded":235348,"packets_dropped":358200,"data_forward_rate_Mbps":3.4327,"data_drop_rate_Mbps":0.0000,"packet_forward_rate_kpps":2.6540,"packet_drop_rate_kpps":0.0000,"overflow_queue_size":0}
Feb 10 19:04:59 sec-bro04 lb: {"ts":1486782299.255037,"interface":"netmap:em2","packets_received":1255048,"packets_forwarded":499143,"packets_dropped":753800,"non_ip_packets":47454,"data_forward_rate_Mbps":7.2036,"data_drop_rate_Mbps":0.0000,"packet_forward_rate_kpps":5.5130,"packet_drop_rate_kpps":0.0000,"free_buffer_slots":1000}

-----Original Message-----
From: Seth Hall [mailto:seth at icir.org] 
Sent: Friday, February 10, 2017 6:54 PM
To: Deshmukh, Andy <deshmukh at slac.stanford.edu>
Cc: Dave Crawford <dave at pingtrip.com>; bro at bro.org
Subject: Re: [Bro] Netmap plugin issue


> On Feb 10, 2017, at 6:43 PM, Deshmukh, Andy <deshmukh at slac.stanford.edu> wrote:
> 
> In my case only 5 instances are running per NIC; cannot run 10/NIC as it crashes. I modified the lb_procs to 5 in node.cfg.
> However, I am not seeing any packet forwarded or dropped. Do you see that on the running instances ?

Netmap doesn't currently mark interfaces as promiscuous when it connects.  If you manually mark the interface promisc, do you get packets?

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/