Menu
▾
▴
Re: [Os-sim-support] sniffing a mirrored port
|
From: Jon U. <jur...@ya...> - 2008-05-10 11:44:55
|
Hi Brian, Try tcpreplay... It's on the Debian repositories. Regards, Jon Brian Lavender escribió: > Sorry to reply to my own post, but it appears I am getting no dropped > packets with the ring buffer and the the preemptive kernel patch. I am > just running ntop at the moment. > > Linux cienfuegos 2.6.24.4-rt4 #3 SMP PREEMPT RT Tue May 6 14:16:06 PDT 2008 i686 GNU/Linux > > cienfuegos:/usr/local/var# cat /proc/net/pf_ring/15651-eth0.17 > Bound Device : eth0 > Version : 9 > Sampling Rate : 1 > IP Defragment : No > BPF Filtering : Disabled > # Filt. Rules : 0 > Cluster Id : 0 > Tot Slots : 4116 > Slot Len : 198 > Data Len : 128 > Tot Memory : 815104 > Tot Packets : 5709987 > Tot Pkt Lost : 0 > Tot Insert : 5709987 > Tot Read : 5709955 > > I did a simple test of transferring files via ftp and monitored it with > ntop. This is a 100Mbit BayNetworks 450-24T switch with traffic from one > port mirrored to another. The receiving mirror port is plugged into an > older dual CPU 667 MHz server with an Intel 100 Mbit card that reports > NAPI capability. > > eth0: Lite-On 82c168 PNIC rev 33 at Port 0x3000, 00:a0:cc:3f:39:64, IRQ 16. > e100: Intel(R) PRO/100 Network Driver, 3.5.23-k4-NAPI > e100: Copyright(c) 1999-2006 Intel Corporation > > Here is the ftp tranfer results. > > ncftp /home/brian > put *.iso > boot.iso: 6.92 MB 11.10 MB/s > CentOS-5.0-i386-bin-1of6.iso: 625.60 MB 10.33 MB/s > CentOS-5.0-i386-bin-2of6.iso: 636.13 MB 8.85 MB/s > CentOS-5.0-i386-bin-3of6.iso: 627.53 MB 9.22 MB/s > CentOS-5.0-i386-bin-4of6.iso: 633.03 MB 8.69 MB/s > CentOS-5.0-i386-bin-5of6.iso: 636.66 MB 8.11 MB/s > CentOS-5.0-i386-bin-6of6.iso: 388.15 MB 8.89 MB/s > debian-40r1-i386-netinst.iso: 163.07 MB 8.75 MB/s > install-x86-minimal-2007.0-r1.iso: 57.16 MB 9.41 MB/s > livecd-xen-3.0.3-0.iso: 674.25 MB 9.08 MB/s > openfiler-2.2-x86-disc1.iso: 323.07 MB 8.31 MB/s > ossim-installer-1.0.4.iso: 326.58 MB 9.17 MB/s > ubuntu-8.04-desktop-i386.iso: 699.12 MB 8.78 MB/s > > I will look at performing some better tests. There must be some traffic > generation tool I can use? > > brian > > On Fri, May 09, 2008 at 04:23:20PM -0700, Brian Lavender wrote: >> Good news is, I just had to ifconfig it with "up", and now I can see the >> packets that are being mirrored to that port. No crossover needed. >> >> # ifconfig eth0 up >> >> cienfuegos:~# ifconfig eth0 >> eth0 Link encap:Ethernet HWaddr 00:50:8B:D9:5D:A2 >> inet6 addr: fe80::250:8bff:fed9:5da2/64 Scope:Link >> UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1 >> RX packets:1150 errors:0 dropped:0 overruns:0 frame:0 >> TX packets:7 errors:0 dropped:0 overruns:0 carrier:0 >> collisions:0 txqueuelen:1000 >> RX bytes:163170 (159.3 KiB) TX bytes:510 (510.0 b) >> >> # tcpdump -vv -i eth0 >> >> Thanks for the input. BTW, this is the box that has the PF_RING and the >> Preemptive linux real time patches. I am curious to see how it works. It >> only has a 100 MB NIC though. I have one of its NICs plugged into a >> Baystack 450-24T managed switch with traffic mirrored from one of the >> ports to the one that is being monitored. >> >> brian >> >> On Fri, May 09, 2008 at 10:07:23PM +0200, Pablo R. wrote: >>> Try to connect a "crossover" cable directly, without the switch and >>> execute tcpdump. It doesn't need to have the 0.0.0.0 address. If it >>> doesn't work, perhaps the port of the switch is broken... or the >>> cable. Ensure that the promisc mode is set in the device that is >>> connected as well. >>> >>> 2008/5/9 Brian Lavender <br...@br...>: >>>> I configured a switch so that it mirrors traffic onto a port. I >>>> connected a cable from that port to an ethernet interface on a system >>>> for monitoring, but I can't see anything with tcpdump. Do I need to >>>> ifconfig the interface with something like 0.0.0.0? I see that when I >>>> run tcpdump the interface goes into promiscuous mode, but I don't see >>>> any traffic. The light on the switch is blinking too at the same rate >>>> as the port it is mirroring. Any tips? >>>> >>>> brian >>>> -- >>>> Brian Lavender >>>> http://www.brie.com/brian/ >>>> >>>> ------------------------------------------------------------------------- >>>> This SF.net email is sponsored by the 2008 JavaOne(SM) Conference >>>> Don't miss this year's exciting event. There's still time to save $100. >>>> Use priority code J8TL2D2. >>>> http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone >>>> _______________________________________________ >>>> Os-sim-support mailing list >>>> Os-...@li... >>>> https://lists.sourceforge.net/lists/listinfo/os-sim-support >>>> >>> >>> >>> -- >>> Saludos >>> Pablo >> -- >> Brian Lavender >> http://www.brie.com/brian/ >> >> ------------------------------------------------------------------------- >> This SF.net email is sponsored by the 2008 JavaOne(SM) Conference >> Don't miss this year's exciting event. There's still time to save $100. >> Use priority code J8TL2D2. >> http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone >> _______________________________________________ >> Os-sim-support mailing list >> Os-...@li... >> https://lists.sourceforge.net/lists/listinfo/os-sim-support > ______________________________________________ Enviado desde Correo Yahoo! La bandeja de entrada más inteligente. |
