Menu
▾
▴
Re: [Os-sim-support] sniffing a mirrored port
|
From: Brian L. <br...@br...> - 2008-05-10 00:49:05
|
Sorry to reply to my own post, but it appears I am getting no dropped packets with the ring buffer and the the preemptive kernel patch. I am just running ntop at the moment. Linux cienfuegos 2.6.24.4-rt4 #3 SMP PREEMPT RT Tue May 6 14:16:06 PDT 2008 i686 GNU/Linux cienfuegos:/usr/local/var# cat /proc/net/pf_ring/15651-eth0.17 Bound Device : eth0 Version : 9 Sampling Rate : 1 IP Defragment : No BPF Filtering : Disabled # Filt. Rules : 0 Cluster Id : 0 Tot Slots : 4116 Slot Len : 198 Data Len : 128 Tot Memory : 815104 Tot Packets : 5709987 Tot Pkt Lost : 0 Tot Insert : 5709987 Tot Read : 5709955 I did a simple test of transferring files via ftp and monitored it with ntop. This is a 100Mbit BayNetworks 450-24T switch with traffic from one port mirrored to another. The receiving mirror port is plugged into an older dual CPU 667 MHz server with an Intel 100 Mbit card that reports NAPI capability. eth0: Lite-On 82c168 PNIC rev 33 at Port 0x3000, 00:a0:cc:3f:39:64, IRQ 16. e100: Intel(R) PRO/100 Network Driver, 3.5.23-k4-NAPI e100: Copyright(c) 1999-2006 Intel Corporation Here is the ftp tranfer results. ncftp /home/brian > put *.iso boot.iso: 6.92 MB 11.10 MB/s CentOS-5.0-i386-bin-1of6.iso: 625.60 MB 10.33 MB/s CentOS-5.0-i386-bin-2of6.iso: 636.13 MB 8.85 MB/s CentOS-5.0-i386-bin-3of6.iso: 627.53 MB 9.22 MB/s CentOS-5.0-i386-bin-4of6.iso: 633.03 MB 8.69 MB/s CentOS-5.0-i386-bin-5of6.iso: 636.66 MB 8.11 MB/s CentOS-5.0-i386-bin-6of6.iso: 388.15 MB 8.89 MB/s debian-40r1-i386-netinst.iso: 163.07 MB 8.75 MB/s install-x86-minimal-2007.0-r1.iso: 57.16 MB 9.41 MB/s livecd-xen-3.0.3-0.iso: 674.25 MB 9.08 MB/s openfiler-2.2-x86-disc1.iso: 323.07 MB 8.31 MB/s ossim-installer-1.0.4.iso: 326.58 MB 9.17 MB/s ubuntu-8.04-desktop-i386.iso: 699.12 MB 8.78 MB/s I will look at performing some better tests. There must be some traffic generation tool I can use? brian On Fri, May 09, 2008 at 04:23:20PM -0700, Brian Lavender wrote: > Good news is, I just had to ifconfig it with "up", and now I can see the > packets that are being mirrored to that port. No crossover needed. > > # ifconfig eth0 up > > cienfuegos:~# ifconfig eth0 > eth0 Link encap:Ethernet HWaddr 00:50:8B:D9:5D:A2 > inet6 addr: fe80::250:8bff:fed9:5da2/64 Scope:Link > UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1 > RX packets:1150 errors:0 dropped:0 overruns:0 frame:0 > TX packets:7 errors:0 dropped:0 overruns:0 carrier:0 > collisions:0 txqueuelen:1000 > RX bytes:163170 (159.3 KiB) TX bytes:510 (510.0 b) > > # tcpdump -vv -i eth0 > > Thanks for the input. BTW, this is the box that has the PF_RING and the > Preemptive linux real time patches. I am curious to see how it works. It > only has a 100 MB NIC though. I have one of its NICs plugged into a > Baystack 450-24T managed switch with traffic mirrored from one of the > ports to the one that is being monitored. > > brian > > On Fri, May 09, 2008 at 10:07:23PM +0200, Pablo R. wrote: > > Try to connect a "crossover" cable directly, without the switch and > > execute tcpdump. It doesn't need to have the 0.0.0.0 address. If it > > doesn't work, perhaps the port of the switch is broken... or the > > cable. Ensure that the promisc mode is set in the device that is > > connected as well. > > > > 2008/5/9 Brian Lavender <br...@br...>: > > > I configured a switch so that it mirrors traffic onto a port. I > > > connected a cable from that port to an ethernet interface on a system > > > for monitoring, but I can't see anything with tcpdump. Do I need to > > > ifconfig the interface with something like 0.0.0.0? I see that when I > > > run tcpdump the interface goes into promiscuous mode, but I don't see > > > any traffic. The light on the switch is blinking too at the same rate > > > as the port it is mirroring. Any tips? > > > > > > brian > > > -- > > > Brian Lavender > > > http://www.brie.com/brian/ > > > > > > ------------------------------------------------------------------------- > > > This SF.net email is sponsored by the 2008 JavaOne(SM) Conference > > > Don't miss this year's exciting event. There's still time to save $100. > > > Use priority code J8TL2D2. > > > http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone > > > _______________________________________________ > > > Os-sim-support mailing list > > > Os-...@li... > > > https://lists.sourceforge.net/lists/listinfo/os-sim-support > > > > > > > > > > > -- > > Saludos > > Pablo > > -- > Brian Lavender > http://www.brie.com/brian/ > > ------------------------------------------------------------------------- > This SF.net email is sponsored by the 2008 JavaOne(SM) Conference > Don't miss this year's exciting event. There's still time to save $100. > Use priority code J8TL2D2. > http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone > _______________________________________________ > Os-sim-support mailing list > Os-...@li... > https://lists.sourceforge.net/lists/listinfo/os-sim-support -- Brian Lavender http://www.brie.com/brian/ |
