[Bro] Netmap plugin issue

[Dave Crawford]

My LB stats are similar, but Bro isn’t reflecting a loss:

Feb 11 04:58:02 mid-csignsm-01 lb[3144]: {"ts":1486807082.815681,"interface":"netmap:eth6","packets_received":739258266,"packets_forwarded":737718676,"packets_dropped":1213100,"non_ip_packets":371283,"data_forward_rate_Mbps":758.6328,"data_drop_rate_Mbps":0.0000,"packet_forward_rate_kpps":102.7250,"packet_drop_rate_kpps":0.0000,"free_buffer_slots":100000}

The next cycle of capture_loss shows less than 1% loss for the 10 workers:

2017-02-11T05:01:56-0500        600.000119      MID_INT-2       5       102927  0.004858
2017-02-11T05:01:56-0500        600.000015      MID_INT-4       7       107577  0.006507
2017-02-11T05:01:56-0500        600.000053      MID_INT-9       6       101979  0.005884
2017-02-11T05:01:56-0500        600.000016      MID_INT-3       1       304887  0.000328
2017-02-11T05:01:56-0500        600.000543      MID_INT-10      5       186552  0.00268
2017-02-11T05:01:56-0500        600.000009      MID_INT-5       6       101433  0.005915
2017-02-11T05:01:56-0500        600.000005      MID_INT-6       5       110256  0.004535
2017-02-11T05:01:56-0500        600.000085      MID_INT-7       1       98164   0.001019
2017-02-11T05:01:56-0500        600.000041      MID_INT-8       4       99979   0.004001
2017-02-11T05:01:57-0500        600.000047      MID_INT-1       3       90591   0.003312

I also noticed that Andy’s LB output is slightly different. His displays the free buffers as “overflow_queue_size” where my output is “free_buffer_slots”.

Also Andy, your overflow queue size is “0”, did you define one and its been depleted? Creating one, or increasing the size may help with the Bro dropped packets.

-Dave

> On Feb 12, 2017, at 12:58 AM, Deshmukh, Andy <deshmukh at slac.stanford.edu> wrote:
> 
> Capture_loss event: 
> 1486803890.282458	900.000048	sec-bro04-1-4	28622	35953	79.60949 
> 
> Lb logs: 
> Feb 11 01:04:50 sec-bro04 lb: {"ts":1486803890.238885,"input_interface":"netmap:em1","output_interface":"netmap:broem1{4/xT at 1","packets_forwarded":6664358,"packets_dropped":177568,"data_forward_rate_Mbps":3.1411,"data_drop_rate_Mbps":0.0000,"packet_forward_rate_kpps":2.0600,"packet_drop_rate_kpps":0.0000,"overflow_queue_size":0}
> 
> On other interfaces it does show some loss but nothing substantial. 
> 
> -----Original Message-----
> From: Seth Hall [mailto:seth at icir.org] 
> Sent: Saturday, February 11, 2017 6:13 PM
> To: Deshmukh, Andy <deshmukh at slac.stanford.edu>
> Cc: Dave Crawford <bro at pingtrip.com>; bro at bro.org
> Subject: Re: [Bro] Netmap plugin issue
> 
> 
>> On Feb 11, 2017, at 1:35 PM, Deshmukh, Andy <deshmukh at slac.stanford.edu> wrote:
>> 
>> Hmm, that’s interesting. For me Bro is reporting the capture loss which kind of matches the overall netmap stats and it is very high:
>> 
>> 1486814690.289371       900.000065      sec-bro04-1-1   4983       28153   17.699712
>> 1486814690.296848       900.000132      sec-bro04-1-5   29050     69353   41.887157
>> 1486814690.283136       900.000080      sec-bro04-1-4   221424  242109 91.456328
>> 1486814690.315410       900.000052      sec-bro04-1-2   26613     65599   40.569216
>> 1486814690.300392       900.000025      sec-bro04-1-3   7591       34491   22.00864
>> 1486815590.289398       900.000027      sec-bro04-1-1   15437     42078   36.68663
>> 1486815590.315530       900.000120      sec-bro04-1-2   913          9650      9.46114
>> 1486815590.283290       900.000154      sec-bro04-1-4   40906     49390   82.822434
> 
> During the time where the data was collected for this capture-loss log, what was the output of lb showing?  Did it show any bursts of loss?
> 
>  .Seth
> 
> --
> Seth Hall
> International Computer Science Institute
> (Bro) because everyone has a network
> http://www.bro.org/
> 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20170212/743834da/attachment-0001.html