[ARGUS] A concrete packet loss example :-)

[Peter Van Epp]

	High :-)? It was a 2 minite run of netperf with a 9K mtu with pretty
much only an ssh to the remote machine to start the netperf going sharing the
network with it. The ring code is set for a 128 byte slice and not to forward
the packets in to the TCP stack so it was presumably tossing most of the data
away after the driver had fetched it from the cards and mmapping the resulting
128 byte samples directly to the modified libpcap library avoiding the copy 
entirely (at least as I understand what the ring code is doing). Here is 
the transaction in question with start and end times displayed so by counting
packets and times we should be able to come up with a packet rate:

29,Oct,04,15:37:35,0.692388,29,Oct,04,15:38:05,0.692380,,6,aaa.bb.cc.dd,43116,->,aaa.bb.cc.eee,37454,372141,188069,3323153814,12439646,CON
29,Oct,04,15:37:35,0.687393,29,Oct,04,15:37:35,0.818177,,6,aaa.bb.cc.dd,43115,->,aaa.bb.cc.eee,12865,5,4,854,784,CON
29,Oct,04,15:38:05,0.692399,29,Oct,04,15:38:35,0.692384,,6,aaa.bb.cc.dd,43116,->,aaa.bb.cc.eee,37454,396986,200009,3533320000,13214202,CON
29,Oct,04,15:38:35,0.692435,29,Oct,04,15:39:05,0.692349,,6,aaa.bb.cc.dd,43116,->,aaa.bb.cc.eee,37454,391813,197857,3491121734,13074438,CON
29,Oct,04,15:39:05,0.692469,29,Oct,04,15:39:35,0.692451,,6,aaa.bb.cc.dd,43116,->,aaa.bb.cc.eee,37454,393189,198259,3501958974,13102734,CON
29,Oct,04,15:39:35,0.701901,29,Oct,04,15:39:35,0.703863,,6,aaa.bb.cc.dd,43115,->,aaa.bb.cc.eee,12865,2,2,132,388,FIN
29,Oct,04,15:39:35,0.692500,29,Oct,04,15:39:35,0.701993,,6,aaa.bb.cc.dd,43116,->,aaa.bb.cc.eee,37454,94,53,834648,3498,FIN

	The tests in the ring code paper indicate that this is the best case
senario (essentially no loss to wire speed with jumbo frames). Smaller packet
sizes still incur loss although its not clear that would be true on my hardware,
since the work in the paper was done on a less powerful machine and I haven't
so far tried it. 
	I also just got my new 4 port regenerator taps so I can put both argus
and my gig sniffer on this link and see if the stuff argus is reporting (a 
machine with multiple encapsulation types is one thing I want to see, many 
instances of retransmissions is another, although they may really be there)
are in fact correct. With my current single tap setup I can have argus or the 
sniffer, but not both (netoptics to the rescue :-)).

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada

On Tue, Nov 02, 2004 at 08:29:53AM -0500, Carter Bullard wrote:
> Hey Peter,
>    Any sense of pkts/sec?
> Carter
> 
> 
> > From: Peter Van Epp <vanepp at sfu.ca>
> > Date: Fri, 29 Oct 2004 15:58:04 -0700
> > To: <argus-info at lists.andrew.cmu.edu>
> > Subject: Re: [ARGUS] A concrete packet loss example :-)
> > 
> > Success looks to have plagued our efforts. On a SUSE 2.6.5-7.108 kernel
> > with the ring buffer bpf code from www.ntop.org running on the dual athelon
> > box described earlier with SysKonnect cards (which by the way need:
> > 
> > /etc/modprobe.conf
> > 
> > options sk98lin Speed_A=1000,1000 AutoNeg_A=Off,Off DupCap_A=Full,Full
> > 
> > to like an optical tap) we managed to get argus to report 13,850,389,170 bytes
> > for a ~13 gigabyte at ~900 meg per second transfer across the Westgrid network
> > with no reported loss on either the interfaces or the ring buffer bpf report.
> > Highly recommended!. We are running around 64Megabytes in the kernel ring
> > buffer and a 30 second reporting interval on argus (the default lost some
> > data).
> > Hopefully no one wants to know how, because the fellow who did the
> > kernel for me leaves on vacation for a month tonite so you'll have to wait
> > :-).
> > 
> > Peter Van Epp / Operations and Technical Support
> > Simon Fraser University, Burnaby, B.C. Canada
> > 
>