Mailing List Archive

[PF_RING] - pfcount report drops
Hello all,

I have a strange issue with pfcount while using x520 intel ixgbe driver.
I use pfcount with bpf filter on a zc nic and see on average 100 packets
that meet the filtering conditions.
every once in a while though, a burst of 10k packets that meets the bpf
conditions shows that pfcount is experiencing 90% drops.

Traffic with no filters at all is at 1Gbps.

Any ideas what can be the reason for this ?

Thank you
B
Re: [PF_RING] - pfcount report drops [ In reply to ]
Hi
I do not think this is somehow related to bpf as there is no additional buffering
with bpf that can explain the burst, filtering happens in userspace after that the
has been captured in the standard ZC way. I think that you have bursts that the
bpf engine is not able to handle (10k packets is just what is passing the filter),
please check the total traffic before bpf to see what is the peak rate.

Alfredo

> On 17 Jul 2018, at 08:14, william de ping <bill.de.ping@gmail.com> wrote:
>
> Hello all,
>
> I have a strange issue with pfcount while using x520 intel ixgbe driver.
> I use pfcount with bpf filter on a zc nic and see on average 100 packets that meet the filtering conditions.
> every once in a while though, a burst of 10k packets that meets the bpf conditions shows that pfcount is experiencing 90% drops.
>
> Traffic with no filters at all is at 1Gbps.
>
> Any ideas what can be the reason for this ?
>
> Thank you
> B
> _______________________________________________
> Ntop-dev mailing list
> Ntop-dev@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-dev
Re: [PF_RING] - pfcount report drops [ In reply to ]
Hi
I do not think this is somehow related to bpf as there is no additional buffering
with bpf that can explain the burst, filtering happens in userspace after that the
has been captured in the standard ZC way. I think that you have bursts that the
bpf engine is not able to handle (10k packets is just what is passing the filter),
please check the total traffic before bpf to see what is the peak rate.

Alfredo

> On 17 Jul 2018, at 08:14, william de ping <bill.de.ping@gmail.com> wrote:
>
> Hello all,
>
> I have a strange issue with pfcount while using x520 intel ixgbe driver.
> I use pfcount with bpf filter on a zc nic and see on average 100 packets that meet the filtering conditions.
> every once in a while though, a burst of 10k packets that meets the bpf conditions shows that pfcount is experiencing 90% drops.
>
> Traffic with no filters at all is at 1Gbps.
>
> Any ideas what can be the reason for this ?
>
> Thank you
> B
> _______________________________________________
> Ntop-dev mailing list
> Ntop-dev@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-dev
Re: [PF_RING] - pfcount report drops [ In reply to ]
Hi,

The traffic without any bpf is less than 3Gbps.
Could the drops I see in pfcount are an indication for filtered traffic
(traffic that does not meet the bpf rule) ?

Thank you
B

On Tue, Jul 17, 2018 at 10:21 AM, Alfredo Cardigliano <cardigliano@ntop.org>
wrote:

> Hi
> I do not think this is somehow related to bpf as there is no additional
> buffering
> with bpf that can explain the burst, filtering happens in userspace after
> that the
> has been captured in the standard ZC way. I think that you have bursts
> that the
> bpf engine is not able to handle (10k packets is just what is passing the
> filter),
> please check the total traffic before bpf to see what is the peak rate.
>
> Alfredo
>
> > On 17 Jul 2018, at 08:14, william de ping <bill.de.ping@gmail.com>
> wrote:
> >
> > Hello all,
> >
> > I have a strange issue with pfcount while using x520 intel ixgbe driver.
> > I use pfcount with bpf filter on a zc nic and see on average 100 packets
> that meet the filtering conditions.
> > every once in a while though, a burst of 10k packets that meets the bpf
> conditions shows that pfcount is experiencing 90% drops.
> >
> > Traffic with no filters at all is at 1Gbps.
> >
> > Any ideas what can be the reason for this ?
> >
> > Thank you
> > B
> > _______________________________________________
> > Ntop-dev mailing list
> > Ntop-dev@listgateway.unipi.it
> > http://listgateway.unipi.it/mailman/listinfo/ntop-dev
>
>
> _______________________________________________
> Ntop-dev mailing list
> Ntop-dev@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-dev
>
Re: [PF_RING] - pfcount report drops [ In reply to ]
Hi,

The traffic without any bpf is less than 3Gbps.
Could the drops I see in pfcount are an indication for filtered traffic
(traffic that does not meet the bpf rule) ?

Thank you
B

On Tue, Jul 17, 2018 at 10:21 AM, Alfredo Cardigliano <cardigliano@ntop.org>
wrote:

> Hi
> I do not think this is somehow related to bpf as there is no additional
> buffering
> with bpf that can explain the burst, filtering happens in userspace after
> that the
> has been captured in the standard ZC way. I think that you have bursts
> that the
> bpf engine is not able to handle (10k packets is just what is passing the
> filter),
> please check the total traffic before bpf to see what is the peak rate.
>
> Alfredo
>
> > On 17 Jul 2018, at 08:14, william de ping <bill.de.ping@gmail.com>
> wrote:
> >
> > Hello all,
> >
> > I have a strange issue with pfcount while using x520 intel ixgbe driver.
> > I use pfcount with bpf filter on a zc nic and see on average 100 packets
> that meet the filtering conditions.
> > every once in a while though, a burst of 10k packets that meets the bpf
> conditions shows that pfcount is experiencing 90% drops.
> >
> > Traffic with no filters at all is at 1Gbps.
> >
> > Any ideas what can be the reason for this ?
> >
> > Thank you
> > B
> > _______________________________________________
> > Ntop-dev mailing list
> > Ntop-dev@listgateway.unipi.it
> > http://listgateway.unipi.it/mailman/listinfo/ntop-dev
>
>
> _______________________________________________
> Ntop-dev mailing list
> Ntop-dev@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-dev
>
Re: [PF_RING] - pfcount report drops [ In reply to ]
Hi
if you mean "pkts dropped” in pfcount, those packets have been dropped because
pfcount with bpf enabled cannot keep up with the ingress rate (not because they are
filtered out). However even bpf, depending on the filter complexity, should be able to
handle that rate. Do you see any packet loss running pfcount without a bpf filter?

Alfredo

> On 18 Jul 2018, at 08:08, william de ping <bill.de.ping@gmail.com> wrote:
>
> Hi,
>
> The traffic without any bpf is less than 3Gbps.
> Could the drops I see in pfcount are an indication for filtered traffic (traffic that does not meet the bpf rule) ?
>
> Thank you
> B
>
> On Tue, Jul 17, 2018 at 10:21 AM, Alfredo Cardigliano <cardigliano@ntop.org <mailto:cardigliano@ntop.org>> wrote:
> Hi
> I do not think this is somehow related to bpf as there is no additional buffering
> with bpf that can explain the burst, filtering happens in userspace after that the
> has been captured in the standard ZC way. I think that you have bursts that the
> bpf engine is not able to handle (10k packets is just what is passing the filter),
> please check the total traffic before bpf to see what is the peak rate.
>
> Alfredo
>
> > On 17 Jul 2018, at 08:14, william de ping <bill.de.ping@gmail.com <mailto:bill.de.ping@gmail.com>> wrote:
> >
> > Hello all,
> >
> > I have a strange issue with pfcount while using x520 intel ixgbe driver.
> > I use pfcount with bpf filter on a zc nic and see on average 100 packets that meet the filtering conditions.
> > every once in a while though, a burst of 10k packets that meets the bpf conditions shows that pfcount is experiencing 90% drops.
> >
> > Traffic with no filters at all is at 1Gbps.
> >
> > Any ideas what can be the reason for this ?
> >
> > Thank you
> > B
> > _______________________________________________
> > Ntop-dev mailing list
> > Ntop-dev@listgateway.unipi.it <mailto:Ntop-dev@listgateway.unipi.it>
> > http://listgateway.unipi.it/mailman/listinfo/ntop-dev <http://listgateway.unipi.it/mailman/listinfo/ntop-dev>
>
>
> _______________________________________________
> Ntop-dev mailing list
> Ntop-dev@listgateway.unipi.it <mailto:Ntop-dev@listgateway.unipi.it>
> http://listgateway.unipi.it/mailman/listinfo/ntop-dev <http://listgateway.unipi.it/mailman/listinfo/ntop-dev>
>
> _______________________________________________
> Ntop-dev mailing list
> Ntop-dev@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-dev
Re: [PF_RING] - pfcount report drops [ In reply to ]
Hi
if you mean "pkts dropped” in pfcount, those packets have been dropped because
pfcount with bpf enabled cannot keep up with the ingress rate (not because they are
filtered out). However even bpf, depending on the filter complexity, should be able to
handle that rate. Do you see any packet loss running pfcount without a bpf filter?

Alfredo

> On 18 Jul 2018, at 08:08, william de ping <bill.de.ping@gmail.com> wrote:
>
> Hi,
>
> The traffic without any bpf is less than 3Gbps.
> Could the drops I see in pfcount are an indication for filtered traffic (traffic that does not meet the bpf rule) ?
>
> Thank you
> B
>
> On Tue, Jul 17, 2018 at 10:21 AM, Alfredo Cardigliano <cardigliano@ntop.org <mailto:cardigliano@ntop.org>> wrote:
> Hi
> I do not think this is somehow related to bpf as there is no additional buffering
> with bpf that can explain the burst, filtering happens in userspace after that the
> has been captured in the standard ZC way. I think that you have bursts that the
> bpf engine is not able to handle (10k packets is just what is passing the filter),
> please check the total traffic before bpf to see what is the peak rate.
>
> Alfredo
>
> > On 17 Jul 2018, at 08:14, william de ping <bill.de.ping@gmail.com <mailto:bill.de.ping@gmail.com>> wrote:
> >
> > Hello all,
> >
> > I have a strange issue with pfcount while using x520 intel ixgbe driver.
> > I use pfcount with bpf filter on a zc nic and see on average 100 packets that meet the filtering conditions.
> > every once in a while though, a burst of 10k packets that meets the bpf conditions shows that pfcount is experiencing 90% drops.
> >
> > Traffic with no filters at all is at 1Gbps.
> >
> > Any ideas what can be the reason for this ?
> >
> > Thank you
> > B
> > _______________________________________________
> > Ntop-dev mailing list
> > Ntop-dev@listgateway.unipi.it <mailto:Ntop-dev@listgateway.unipi.it>
> > http://listgateway.unipi.it/mailman/listinfo/ntop-dev <http://listgateway.unipi.it/mailman/listinfo/ntop-dev>
>
>
> _______________________________________________
> Ntop-dev mailing list
> Ntop-dev@listgateway.unipi.it <mailto:Ntop-dev@listgateway.unipi.it>
> http://listgateway.unipi.it/mailman/listinfo/ntop-dev <http://listgateway.unipi.it/mailman/listinfo/ntop-dev>
>
> _______________________________________________
> Ntop-dev mailing list
> Ntop-dev@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-dev