[Bro] Netmap plugin issue

Deshmukh, Andy deshmukh at slac.stanford.edu
Sat Feb 11 10:35:16 PST 2017


Hmm, that’s interesting. For me Bro is reporting the capture loss which kind of matches the overall netmap stats and it is very high:

1486814690.289371       900.000065      sec-bro04-1-1   4983       28153   17.699712
1486814690.296848       900.000132      sec-bro04-1-5   29050     69353   41.887157
1486814690.283136       900.000080      sec-bro04-1-4   221424  242109 91.456328
1486814690.315410       900.000052      sec-bro04-1-2   26613     65599   40.569216
1486814690.300392       900.000025      sec-bro04-1-3   7591       34491   22.00864
1486815590.289398       900.000027      sec-bro04-1-1   15437     42078   36.68663
1486815590.315530       900.000120      sec-bro04-1-2   913          9650      9.46114
1486815590.283290       900.000154      sec-bro04-1-4   40906     49390   82.822434

From: Dave Crawford [mailto:bro at pingtrip.com]
Sent: Friday, February 10, 2017 8:25 PM
To: Deshmukh, Andy <deshmukh at slac.stanford.edu>
Cc: Seth Hall <seth at icir.org>; bro at bro.org
Subject: Re: [Bro] Netmap plugin issue


On Feb 10, 2017, at 10:07 PM, Deshmukh, Andy <deshmukh at slac.stanford.edu<mailto:deshmukh at slac.stanford.edu>> wrote:

Yea!! I totally forgot about that...
But the packet_drop is very high! Is it cause of the tweaks in modprobe.d ?

I have the same observations Andy.

{"ts":1486786393.408004,"interface":"netmap:eth6","packets_received":3816916,"packets_forwarded":2495606,"packets_dropped":1213100,"non_ip_packets":2014,"data_forward_rate_Mbps":93.6190,"data_drop_rate_Mbps":0.0000,"packet_forward_rate_kpps":29.4030,"packet_drop_rate_kpps":0.0000,"free_buffer_slots":100000}

Wouldn’t a 30% packet loss result in a high number of weird.log messages as well as a high capture_loss? Bro is reporting under 1% for that worker.

1486786916.930127       600.000012      MID_INT-9       21      120263  0.017462
1486786916.899102       600.000025      MID_INT-2       26      113792  0.022849
1486786916.913207       600.000046      MID_INT-5       17      114020  0.01491
1486786917.062056       600.000040      MID_INT-1       37      122988  0.030084
1486786916.899164       600.000046      MID_INT-6       20      117978  0.016952
1486786916.898184       600.000043      MID_INT-8       10      117535  0.008508
1486786916.899106       600.000023      MID_INT-10      31      135819  0.022824
1486786916.899611       600.000023      MID_INT-3       19      130912  0.014514
1486786916.902911       600.000014      MID_INT-7       24      144454  0.016614
1486786916.897984       600.000029      MID_INT-4       25      106400  0.023496

-Dave



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20170211/6e196507/attachment-0001.html 


More information about the Bro mailing list