Dropped Packets on PF_RING

[Tamahome-M]

cat /proc/net/pf_ring/3973-enp4s0.7

Bound Device(s) : enp4s0
Active : 1
Breed : Standard
Appl. Name : ntopng
Socket Mode : RX only
Capture Direction : RX+TX
Sampling Rate : 1
Filtering Sampling Rate: 0
IP Defragment : Yes
BPF Filtering : Disabled
Sw Filt Hash Rules : 0
Sw Filt WC Rules : 0
Sw Filt Hash Match : 0
Sw Filt Hash Miss : 0
Sw Filt Hash Filtered : 0
Hw Filt Rules : 0
Poll Pkt Watermark : 8
Num Poll Calls : 0
Poll Watermark Timeout : 0
Channel Id Mask : 0xFFFFFFFFFFFFFFFF
VLAN Id : 65535
Slot Version : 17 [7.5.0]
Min Num Slots : 65536
Bucket Len : 9040
Slot Len : 9088 [bucket+header]
Tot Memory : 595603456
Tot Packets : 584320077
Tot Pkt Lost : 320343106
Tot Insert : 263976971
Tot Read : 263167785
Insert Offset : 403682144
Remove Offset : 403702728
Num Free Slots : 0
Reflect: Fwd Ok : 0
Reflect: Fwd Errors : 0

Linux netflow 4.19.57-gentoo #4 SMP Thu Jul 25 11:35:06 MSK 2019 x86_64 Intel(R) Xeon(R) CPU E5-2620 v3 @ 2.40GHz GenuineIntel GNU/Linux

What can be done to solve this problem?

[cardigliano]

@Tamahome-M could you provide statistics about the traffic rate (pps / bps)?
You should be able to see the current rate also in the footer.

[Tamahome-M]

from ntopng 934.58 Mbit/s [168,788 pps]
v.3.9.190725 [Community build]
GIT rev: dev:ce1b9821de33e5ff5c608d0cbc169f44bb7cbbd0:20190725

real traffic from snmp (zabbix) ~0.5Mpps ~2.4Gbps

[cardigliano]

@Tamahome-M we recommend using ZC drivers with RSS (multiple queues) above 1 Gbps as a single ntopng thread cannot keep up with high rate traffic. Please read:
https://www.ntop.org/ntopng/best-practices-for-running-ntopng/
https://www.ntop.org/guides/ntopng/advanced_features/view_interfaces.html

[Tamahome-M]

As I understand it, ZC does not work for "Ethernet controller: Mellanox Technologies MT27520 Family [ConnectX-3 Pro]"
Well, I think it's easier to get an INTEL X710 to solve the problem.

[cardigliano]

ZC drivers work with Intel adapters only. There is a full list at https://www.ntop.org/guides/pf_ring/zc.html
We have native supports for other adapters as described at https://www.ntop.org/guides/pf_ring/modules/index.html
However in your case I recommend an Intel one, X520 (better) or X710

[Tamahome-M]

I found Intel Corporation Ethernet Controller X710 for 10GbE SFP+ (rev 01)

./pfcount -i zc:enp3s0f1
=========================
Absolute Stats: [5'024'768 pkts total][0 pkts dropped][0.0% dropped]
[5'024'768 pkts rcvd][4'454'323'266 bytes rcvd][418'707.81 pkt/sec][2'969.38 Mbit/sec]
=========================
Actual Stats: [381'292 pkts rcvd][1'000.05 ms][381'272.55 pps][2.73 Gbps]
=========================

but ntopng "Dropped Packets" ~50%

[cardigliano]

@Tamahome-M what is the peak pps rate that you see? Please note that ntopng is able to process max ~1Gbps per thread, using ZC redices the overhead on the capture size, however it seems you are hitting a bottlebeck in ntopng now. One option for improving the performance is distributing the load across multiple threads with RSS and views, please read https://www.ntop.org/ntopng/best-practices-for-running-ntopng/

[Tamahome-M]

It seems I don’t even need to use the ZC.
This is what confused me when using the “view”, it seems this is a display problem: