14.04.2019

FastNetMon port mirror configuration

In this mode you need to configure port mirror / SPAN / TAP from your switch or router device. We suggest using separate interface for management connection with FastNetMon for reliability reasons.

Enable plugin for mirror capture:

List all available interfaces for your system:

Enable capture for specific port (you may specify any number of ports):

Apply changes:

Then enable port mirroring on router or switch side.

If you do not see all traffic in FastNetMon and all your CPU cores are busy we can suggest enabling sampling with reasonable value (100-512) and it will reduce CPU load without any impact on accuracy of calculations.

By default, FastNetMon will run 1 worker thread for each queue on NIC. For many modern NICs number of queues is set to number of active cores. In cases when your machine has many cores (16, 24 or more) it may lead to lock contention and then you will see all CPU cores busy but traffic will be under counted. In this case we suggest setting lower number of queues on NIC this way:

Another option to improve mirro capture performance is fanout type, FastNetMon has support for following fanout algorithms (for more details, please check this page in PACKET_FANOUT section):

  • cpu
  • lb
  • hash
  • random
  • rollover
  • queue_mapping

By default, FastNetMon uses “cpu” but you can easily change it this way:

In some cases when your CPU has very good single core peformance you can try disabling multi-thread processing (AF_PACKET fanout) and process all traffic for particular interface with single core this way:

Each AF_PACKET socket has multiple counters about number of packets dropped due to performance issues. This option is disabled by default but you can easily enable it this way:

After enabling this option you will see two more counters for following debug command:

Example output:

If you have any performance issues with this capture mode, we suggest testing new experimental capture plugin: AF_XDP.