[Oisf-users] [EXT] Re: Packet loss and increased resource consumption after upgrade to 4.1.2 with Rust support

[Peter Manev]

On Tue, Feb 26, 2019 at 6:00 PM Cloherty, Sean E <scloherty at mitre.org> wrote:
>
> Thanks  - that is a handy way to find top talkers.  In the past I've also used Darkstat which is a bit old but works https://unix4lyfe.org/darkstat/
>
>
>
> In my case though, the drops don't usually happen during peak traffic times and often there are much higher peaks within a day or two when no packets are dropped.  This is specifically about The Zabbix graphs I use rarely show a sloped line,  but a flat line at zero for days before and after.  The chart below is a perfect example.  Looking at the graph on the far right - at some point on Feb. 6 packet drops went from zero to 15 million w/in a 10 minute span and then continued with no further drops.  Looking at the chart on the far left shows the normal rhythm of daily traffic and no abnormal spike and one peak over 2Gbps.  The following week shows a significant increase in traffic including a spike over 3Gbps but no additional drops during that time.  That is why I don’t think it is volume which is causing this.  If it were I would increase the rx buffers on the NIC from the 512 I have it set to right now.
>
>
>

Would be interesting if that drop timeslot  could be correlated to
other stats - ex maybe memcap hits or invalids etc ?

>
>
>
>
> I did check into the monitoring potential but it seems that nobody is aware of jumbo packets in use on monitored LAN segments nor in testing tools.  If that was happening, would is show up in the stats under decoder.max_pkt_size ?  Maybe I need to add that stat and monitor.  To date the largest packet size has been 6520.
>
>




-- 
Regards,
Peter Manev