FastNetMon port mirror configuration

In this mode you need to configure port mirror / SPAN / TAP from your switch or router device. We suggest using separate interface for management connection with FastNetMon for reliability reasons.

Enable plugin for mirror capture:

sudo fcli set main mirror_afpacket enable

List all available interfaces for your system:

sudo fcli show interfaces

Enable capture for specific port (you may specify any number of ports):

sudo fcli set main interfaces em1

Apply changes:

sudo fcli commit

Then enable port mirroring on router or switch side.

If you do not see all traffic in FastNetMon and all your CPU cores are busy we can suggest enabling sampling with reasonable value (100-512) and it will reduce CPU load without any impact on accuracy of calculations.

sudo fcli set main mirror_af_packet_sampling enable
sudo fcli set main mirror_af_packet_sampling_rate 100
sudo fcli commit

By default, FastNetMon will run 1 worker thread for each queue on NIC. For many modern NICs number of queues is set to number of active cores. In cases when your machine has many cores (16, 24 or more) it may lead to lock contention and then you will see all CPU cores busy but traffic will be under counted. In this case we suggest setting lower number of queues on NIC this way:

sudo ethtool --set-channels eth4 combined 8

Another option to improve mirro capture performance is fanout type, FastNetMon has support for following fanout algorithms (for more details, please check this page in PACKET_FANOUT section):

  • cpu
  • lb
  • hash
  • random
  • rollover
  • queue_mapping

By default, FastNetMon uses “cpu” but you can easily change it this way:

sudo fcli set main mirror_af_packet_fanout_mode cpu
sudo fcli commi

In some cases when your CPU has very good single core peformance you can try disabling multi-thread processing (AF_PACKET fanout) and process all traffic for particular interface with single core this way:

sudo fcli set main mirror_af_packet_disable_multithreading enable
sudo fcli commit

Each AF_PACKET socket has multiple counters about number of packets dropped due to performance issues. This option is disabled by default but you can easily enable it this way:

sudo fcli set main  mirror_af_packet_socket_stats enable
sudo fcli commit

After enabling this option you will see two more counters for following debug command:

sudo fcli show system_counters |grep socket 

Example output:

socket_received_packets                  0 
socket_dropped_packets                   0 

If you have any performance issues with this capture mode, we suggest testing new experimental capture plugin: AF_XDP.