10.12.2017

FastNetMon community fine tuning

I recommend you to disable CPU freq scaling for gain max performance (max frequency):

You can use script irq_balance_manually.sh for irq balancing on heavy loaded networks.

Running tool without root permissions:

Please keep in mind when run tool on OpenVZ because without root permissions tool can’t get all VE ips and you should pass it explicitly.

Debugging flags.

DUMP_ALL_PACKETS will enable all packets dumping to /var/log/fastnetmon.log. It’s very useful for testing tool on non standard platforms.

If you want to dump only “other” (we could not detect direction for this packets) packets, please use: DUMP_OTHER_PACKETS.

Recommended configuration options for ixgbe Intel X540 driver (netmap mode):

I got very big packet size (more than mtu) in attack log? In PF_RING this behaviour will be related with offload features of NIC. For Intel 82599 I recommend disable all offload:

How I can compile FastNetMon without PF_RING support?

If you saw intel_idle in perf top with red higlihting you can disable it with following kernel params (more details you can find Performance_Tuning_Guide_for_Mellanox_Network_Adapters.pdf):

If you want build with clang:

If tou want build tool with debug info:

If you want speedup build process please build with ninja instead of make:

Ninja use all CPUs for build process:

Build script for reading Netflow (v5, v9, ipfix) data from pcap dump:

Run pcap data:

How to run tests?

Compile and install Google Test Library:

Build and run tests:

Build script for running packet capture plugins without analyzer backend:

Examples for different plugins (plugin name could be netflow, netmap, sflow, pfring, pcap):

How to collect data for debugging netflow:

How to collect data for debugging sFLOW:

Performance tuning:

Do not use short prefixes (lesser then /24)
Do not use extremely big prefixes (/8, /16) because memory consumption will be very big

How I can enable ZC support for PF_RING? Please install DNA/ZC drivers, load they and add interface name with zc prefix in config file (i.e. zc:eth3)

For development new code, please check .clang-format as code guide example.