<div>The ixgbe large-receive-offload setting should only be turned on when the NIC is the endpoint (i.e., in a server say); extra work needs to be done to get the content of the packets when you're using the NIC (and machine) in bridge/inline mode. I usually compile the ixgbe driver to turn this setting off by default for inline use.</div>
<div><br></div><div>Cheers,</div><div><br></div><div>Dave</div><br><div class="gmail_quote">On Wed, May 30, 2012 at 9:49 AM, Chris Wakelin <span dir="ltr"><<a href="mailto:c.d.wakelin@reading.ac.uk" target="_blank">c.d.wakelin@reading.ac.uk</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">On 30/05/12 10:39, Peter Bates wrote:<br>
><br>
> Hello again all<br>
><br>
> Adding a point to my own reply...<br>
><br>
> On 30/05/2012 09:29, Peter Bates wrote:<br>
>> When I first had the 10Gb NIC up I was seeing (in ifconfig) rx<br>
>> dropped increasing and no rx packets received - and subsequently<br>
>> nothing to capture in tcpdump/etc - however as the advice above<br>
>> changes all the settings to 'off' I was unsure which one<br>
>> actually solved my problem.<br>
><br>
> My ixgbe settings are now: Offload parameters for eth6:<br>
> rx-checksumming: on tx-checksumming: on scatter-gather: on<br>
> tcp-segmentation-offload: on udp-fragmentation-offload: off<br>
> generic-segmentation-offload: on generic-receive-offload: on<br>
> large-receive-offload: off rx-vlan-offload: off tx-vlan-offload:<br>
> off ntuple-filters: off receive-hashing: off<br>
><br>
> ... I find when I turn 'large-receive-offload' on then my NIC<br>
> stops receiving packets and drops everything.<br>
><br>
> I'm receiving traffic from a Cisco SPAN not sure whether it<br>
> encapsulates the packets or makes them larger than 1514 hence this<br>
> setting disturbing the capture.<br>
<br>
</div>It might be worth trying a higher MTU, say "ifconfig eth6 mtu 1522".<br>
Are there VLAN tags on the port? Our Extreme border switches add VLAN<br>
tags to the port mirror in one direction only :-o<br>
<br>
It might also be worth compiling your own ixgbe driver from<br>
<a href="http://sourceforge.net/projects/e1000/files/ixgbe%20stable/" target="_blank">http://sourceforge.net/projects/e1000/files/ixgbe%20stable/</a> or with<br>
PF_RING as the one shipped in the 2.6.x kernels seems very old.<br>
<br>
I'm using PF_RING-enabled ixgbe-3.7.17 (DNA version at the moment) and<br>
have left the offload parameters at the defaults:<br>
<br>
Offload parameters for dna0:<br>
<div class="im">rx-checksumming: on<br>
tx-checksumming: on<br>
scatter-gather: on<br>
tcp-segmentation-offload: on<br>
udp-fragmentation-offload: off<br>
generic-segmentation-offload: on<br>
generic-receive-offload: on<br>
</div>large-receive-offload: on<br>
<div class="im">rx-vlan-offload: off<br>
tx-vlan-offload: off<br>
ntuple-filters: off<br>
receive-hashing: off<br>
<br>
<br>
</div>driver: ixgbe<br>
version: 3.7.17-DNA<br>
firmware-version: 0x18f60001<br>
bus-info: 0000:0c:00.0<br>
supports-statistics: yes<br>
supports-test: yes<br>
supports-eeprom-access: yes<br>
supports-register-dump: yes<br>
supports-priv-flags: no<br>
<div class="im HOEnZb"><br>
Best Wishes,<br>
Chris<br>
<br>
--<br>
--+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+-<br>
Christopher Wakelin, <a href="mailto:c.d.wakelin@reading.ac.uk">c.d.wakelin@reading.ac.uk</a><br>
IT Services Centre, The University of Reading, Tel: <a href="tel:%2B44%20%280%29118%20378%202908" value="+441183782908">+44 (0)118 378 2908</a><br>
Whiteknights, Reading, RG6 6AF, UK Fax: <a href="tel:%2B44%20%280%29118%20975%203094" value="+441189753094">+44 (0)118 975 3094</a><br>
</div><div class="HOEnZb"><div class="h5">_______________________________________________<br>
Oisf-users mailing list<br>
<a href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a><br>
<a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div>".... We are such stuff</div><div>As dreams are made on; and our little life</div><div><div>Is rounded with a sleep."</div></div><div>
-- Shakespeare, The Tempest - Act 4</div><br>