<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>After running with lower values for about half a day, I still get 30% loss.<div>I ran your command and got this as an output:</div><div><div>100000 packets captured</div><div>100000 packets received by filter</div><div>0 packets dropped by kernel</div><div> 38278 ...</div><div><br></div><div>This sensor does not see netflix/youtube traffic. </div><div><br></div><div>What would be the best tool that you recommend to profile my traffic?</div><div><br></div><div>Thanks.</div><br><div>> Subject: Re: [Oisf-users] packet loss troubleshooting<br>> To: latt0050@umn.edu<br>> CC: coolyasha@hotmail.com; oisf-users@lists.openinfosecfoundation.org<br>> From: cnelson@ucsd.edu<br>> Date: Wed, 9 Dec 2015 13:24:45 -0800<br>> <br>> -----BEGIN PGP SIGNED MESSAGE-----<br>> Hash: SHA1<br>> <br>> I use this script to troubleshoot "live" performance issues on our sensor.<br>> <br>> > #!/bin/bash<br>> > <br>> > sudo tcpdump -tnn -c 100000 -i eth2 | awk -F "." '{print $1"."$2"."$3"."$4}' | sort | uniq -c | sort -nr | awk ' $1 > 100 '<br>> <br>> Adjust the interface and packet count (-c) as necessary for your system.<br>> <br>> In our case, it turned out about 1/3 of our network traffic originates<br>> from a single /24 on our ISP that uses for host CDN servers (like<br>> Netflix).<br>> <br>> - -Coop<br>> <br>> On 12/9/2015 1:13 PM, Brandon Lattin wrote:<br>> > Keep in mind that large flows can induce bursty packetloss.<br>> > <br>> > For instance, a perfSonar network monitoring device will test bandwidth<br>> > by shoving many gigabytes of max MTU null padded packets through the<br>> > pipe to a remote perfSonar box. This will result in the whole stream<br>> > being buffered and fed to a single core due to tuple hashing. Chances<br>> > are good that your buffer won't flush fast enough and you'll start<br>> > dropping packets. <br>> > <br>> > Long story short. Know your traffic. See what netflow has to say.<br>> <br>> <br>> - -- <br>> Cooper Nelson<br>> Network Security Analyst<br>> UCSD ACT Security Team<br>> cnelson@ucsd.edu x41042<br>> -----BEGIN PGP SIGNATURE-----<br>> Version: GnuPG v2.0.17 (MingW32)<br>> <br>> iQEcBAEBAgAGBQJWaJwdAAoJEKIFRYQsa8FWkN4H/24Az++Su5kP5kkcdv56A1qy<br>> ljlfHBs3dJenU1PalBF2kBMlSBcN6SZSBpGXdlzIiLtNfCUlXO/uEX3KnNwgknRP<br>> y2y08mAvL9V1l9COtV8k+aLvSO4tps16JTAPG47YkC2NAesIoSlS9wJOmzKvYoTD<br>> cokPPLZbncgI58S4BHk53W+kwIrueUQ2PF6QfCyTei9+StVKyHbwDJnSs65GxYWx<br>> fPmiGblBh6yfZ0fQSSYpBnjFLMGYcATtzPJVNQ1xDY/L5cYnLuEg4Q9oYDTIB0C1<br>> wlrCZp9HvSGh93Nr/SM6GdH2vpzUuLSnwdtHsFbZVWbuooC+ymSc8cttYtSsHfw=<br>> =oNwY<br>> -----END PGP SIGNATURE-----<br></div></div> </div></body>
</html>