[Bro] Netmap plugin issue
Deshmukh, Andy
deshmukh at slac.stanford.edu
Sat Feb 11 10:35:16 PST 2017
Hmm, that’s interesting. For me Bro is reporting the capture loss which kind of matches the overall netmap stats and it is very high:
1486814690.289371 900.000065 sec-bro04-1-1 4983 28153 17.699712
1486814690.296848 900.000132 sec-bro04-1-5 29050 69353 41.887157
1486814690.283136 900.000080 sec-bro04-1-4 221424 242109 91.456328
1486814690.315410 900.000052 sec-bro04-1-2 26613 65599 40.569216
1486814690.300392 900.000025 sec-bro04-1-3 7591 34491 22.00864
1486815590.289398 900.000027 sec-bro04-1-1 15437 42078 36.68663
1486815590.315530 900.000120 sec-bro04-1-2 913 9650 9.46114
1486815590.283290 900.000154 sec-bro04-1-4 40906 49390 82.822434
From: Dave Crawford [mailto:bro at pingtrip.com]
Sent: Friday, February 10, 2017 8:25 PM
To: Deshmukh, Andy <deshmukh at slac.stanford.edu>
Cc: Seth Hall <seth at icir.org>; bro at bro.org
Subject: Re: [Bro] Netmap plugin issue
On Feb 10, 2017, at 10:07 PM, Deshmukh, Andy <deshmukh at slac.stanford.edu<mailto:deshmukh at slac.stanford.edu>> wrote:
Yea!! I totally forgot about that...
But the packet_drop is very high! Is it cause of the tweaks in modprobe.d ?
I have the same observations Andy.
{"ts":1486786393.408004,"interface":"netmap:eth6","packets_received":3816916,"packets_forwarded":2495606,"packets_dropped":1213100,"non_ip_packets":2014,"data_forward_rate_Mbps":93.6190,"data_drop_rate_Mbps":0.0000,"packet_forward_rate_kpps":29.4030,"packet_drop_rate_kpps":0.0000,"free_buffer_slots":100000}
Wouldn’t a 30% packet loss result in a high number of weird.log messages as well as a high capture_loss? Bro is reporting under 1% for that worker.
1486786916.930127 600.000012 MID_INT-9 21 120263 0.017462
1486786916.899102 600.000025 MID_INT-2 26 113792 0.022849
1486786916.913207 600.000046 MID_INT-5 17 114020 0.01491
1486786917.062056 600.000040 MID_INT-1 37 122988 0.030084
1486786916.899164 600.000046 MID_INT-6 20 117978 0.016952
1486786916.898184 600.000043 MID_INT-8 10 117535 0.008508
1486786916.899106 600.000023 MID_INT-10 31 135819 0.022824
1486786916.899611 600.000023 MID_INT-3 19 130912 0.014514
1486786916.902911 600.000014 MID_INT-7 24 144454 0.016614
1486786916.897984 600.000029 MID_INT-4 25 106400 0.023496
-Dave
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20170211/6e196507/attachment-0001.html
More information about the Bro
mailing list