[Bro] Netmap plugin issue

[Dave Crawford]

Continuing to see impressive performance with Bro+Netmap:

data_forward_rate_Mbps":1484.1698"
data_drop_rate_Mbps":0.0000"

And of the 10 workers, the greatest capture_loss reported by Bro is well under 1%:

2017-02-13T09:01:56-0500        600.000013      MID_INT-8       1221    3368533 0.036247

-Dave

> On Feb 12, 2017, at 7:15 AM, Dave Crawford <bro at pingtrip.com> wrote:
> 
> My LB stats are similar, but Bro isn’t reflecting a loss:
> 
> Feb 11 04:58:02 mid-csignsm-01 lb[3144]: {"ts":1486807082.815681,"interface":"netmap:eth6","packets_received":739258266,"packets_forwarded":737718676,"packets_dropped":1213100,"non_ip_packets":371283,"data_forward_rate_Mbps":758.6328,"data_drop_rate_Mbps":0.0000,"packet_forward_rate_kpps":102.7250,"packet_drop_rate_kpps":0.0000,"free_buffer_slots":100000}
> 
> The next cycle of capture_loss shows less than 1% loss for the 10 workers:
> 
> 2017-02-11T05:01:56-0500        600.000119      MID_INT-2       5       102927  0.004858
> 2017-02-11T05:01:56-0500        600.000015      MID_INT-4       7       107577  0.006507
> 2017-02-11T05:01:56-0500        600.000053      MID_INT-9       6       101979  0.005884
> 2017-02-11T05:01:56-0500        600.000016      MID_INT-3       1       304887  0.000328
> 2017-02-11T05:01:56-0500        600.000543      MID_INT-10      5       186552  0.00268
> 2017-02-11T05:01:56-0500        600.000009      MID_INT-5       6       101433  0.005915
> 2017-02-11T05:01:56-0500        600.000005      MID_INT-6       5       110256  0.004535
> 2017-02-11T05:01:56-0500        600.000085      MID_INT-7       1       98164   0.001019
> 2017-02-11T05:01:56-0500        600.000041      MID_INT-8       4       99979   0.004001
> 2017-02-11T05:01:57-0500        600.000047      MID_INT-1       3       90591   0.003312
> 
> I also noticed that Andy’s LB output is slightly different. His displays the free buffers as “overflow_queue_size” where my output is “free_buffer_slots”.
> 
> Also Andy, your overflow queue size is “0”, did you define one and its been depleted? Creating one, or increasing the size may help with the Bro dropped packets.
> 
> -Dave

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20170213/dfc68497/attachment-0001.html