[Bro] Netmap plugin issue

[Deshmukh, Andy]

Capture_loss event: 
1486803890.282458	900.000048	sec-bro04-1-4	28622	35953	79.60949 

Lb logs: 
Feb 11 01:04:50 sec-bro04 lb: {"ts":1486803890.238885,"input_interface":"netmap:em1","output_interface":"netmap:broem1{4/xT at 1","packets_forwarded":6664358,"packets_dropped":177568,"data_forward_rate_Mbps":3.1411,"data_drop_rate_Mbps":0.0000,"packet_forward_rate_kpps":2.0600,"packet_drop_rate_kpps":0.0000,"overflow_queue_size":0}

On other interfaces it does show some loss but nothing substantial. 

-----Original Message-----
From: Seth Hall [mailto:seth at icir.org] 
Sent: Saturday, February 11, 2017 6:13 PM
To: Deshmukh, Andy <deshmukh at slac.stanford.edu>
Cc: Dave Crawford <bro at pingtrip.com>; bro at bro.org
Subject: Re: [Bro] Netmap plugin issue


> On Feb 11, 2017, at 1:35 PM, Deshmukh, Andy <deshmukh at slac.stanford.edu> wrote:
> 
> Hmm, that’s interesting. For me Bro is reporting the capture loss which kind of matches the overall netmap stats and it is very high:
>  
> 1486814690.289371       900.000065      sec-bro04-1-1   4983       28153   17.699712
> 1486814690.296848       900.000132      sec-bro04-1-5   29050     69353   41.887157
> 1486814690.283136       900.000080      sec-bro04-1-4   221424  242109 91.456328
> 1486814690.315410       900.000052      sec-bro04-1-2   26613     65599   40.569216
> 1486814690.300392       900.000025      sec-bro04-1-3   7591       34491   22.00864
> 1486815590.289398       900.000027      sec-bro04-1-1   15437     42078   36.68663
> 1486815590.315530       900.000120      sec-bro04-1-2   913          9650      9.46114
> 1486815590.283290       900.000154      sec-bro04-1-4   40906     49390   82.822434

During the time where the data was collected for this capture-loss log, what was the output of lb showing?  Did it show any bursts of loss?

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/