In this mode you need to configure port mirror / SPAN / TAP from your switch or router device. We suggest using separate interface for management connection with FastNetMon for reliability reasons.
Enable plugin for mirror capture:
sudo fcli set main mirror_afpacket enable
List all available interfaces for your system:
sudo fcli show interfaces
Enable capture for specific port (you may specify any number of ports):
sudo fcli set main interfaces em1
sudo fcli commit
Then enable port mirroring on router or switch side.
If you do not see all traffic in FastNetMon and all your CPU cores are busy we can suggest enabling sampling with reasonable value (100-512) and it will reduce CPU load without any impact on accuracy of calculations.
sudo fcli set main mirror_af_packet_sampling enable sudo fcli set main mirror_af_packet_sampling_rate 100 sudo fcli commit
By default, FastNetMon will run 1 worker thread for each queue on NIC. For many modern NICs number of queues is set to number of active cores. In cases when your machine has many cores (16, 24 or more) it may lead to lock contention and then you will see all CPU cores busy but traffic will be under counted. In this case we suggest setting lower number of queues on NIC this way:
sudo ethtool --set-channels eth4 combined 8
Another option to improve mirro capture performance is fanout type, FastNetMon has support for following fanout algorithms (for more details, please check this page in PACKET_FANOUT section):
By default, FastNetMon uses “cpu” but you can easily change it this way:
sudo fcli set main mirror_af_packet_fanout_mode cpu sudo fcli commi
In some cases when your CPU has very good single core peformance you can try disabling multi-thread processing (AF_PACKET fanout) and process all traffic for particular interface with single core this way:
sudo fcli set main mirror_af_packet_disable_multithreading enable sudo fcli commit
Each AF_PACKET socket has multiple counters about number of packets dropped due to performance issues. This option is disabled by default but you can easily enable it this way:
sudo fcli set main mirror_af_packet_socket_stats enable sudo fcli commit
After enabling this option you will see two more counters for following debug command:
sudo fcli show system_counters |grep socket
socket_received_packets 0 socket_dropped_packets 0