search

ntop / ntopng

Web-based Traffic and Security Network Traffic Monitoring
http://www.ntop.org
GNU General Public License v3.0
6.21k stars 651 forks source link

Potential issue with jumbo frame capture #8201

Closed huntson closed 2 months ago

huntson commented 8 months ago

Environment:

This is currently running as a docker so let me know if I need to provide additional information on that here. What happened: I've been noticing lately that the little traffic graph at the top of the UI matches the actual throughput on the selected interface (confirmed by other networking tools) however the top items in the Live Flow list do not even come close to totaling that number. We're doing a lot of file transfers so it's easy to tell by eye if something is not right.

How did you reproduce it?

Just start the docker and browse.

Debug Information:

How does one get the debug info from the docker?

Perhaps the below logs have something to do with it? We are using jumbo frames. Is there a way to enable those?

Screenshot 2024-02-02 at 3 18 06 PM

Screenshot 2024-02-02 at 3 17 06 PM

huntson commented 6 months ago

Bump

lucaderi commented 5 months ago

You should not enable jumbos, but execute the ethtool commands as in the picture above. As of the other problem @MatteoBiscosi is working at it.

huntson commented 4 months ago

That you for responding. I'm a bit confused here. You're saying I shouldn't enable jumbo frames on my NICs? Kind of required for my application here. Also, you're saying I should run " ethtool -K eth7 gro off gso off tso off" as part of my startup argument for ntopng?

huntson commented 4 months ago

Bump

cardigliano commented 2 months ago

ntopng was reporting packets bigger than the mtu (bigger than the jumbo mtu). This usually means that receive offloads (gro) are enabled in the adapter and should be disabled via ethtool as suggested. This is a good practice as a network monitoring tool needs to see the traffic as it is on the wire in order to compute statistics correctly.