search

stanford-esrg / retina

Retina is a network analysis framework that supports 100+ Gbps traffic analysis on a single server with no specialized hardware.
Apache License 2.0
147 stars 23 forks source link

Mempool usage becomes 100% over time #73

Open HKalbasi opened 2 hours ago

HKalbasi commented 2 hours ago

I'm replaying a ~5GB pcap file in a nic and using a modified basic example which uses online configuration. In that setup, I see after each iteration of the replay, mempool usage goes up around ~14%, and so after 7 or 8 replays it becomes 100% and then retina drops everything.

I'm using a mempool with capacity 655350 so it gets ~1.3GB of ram I think. I can increase the amount of mempool, but it just delays the failure,

I can easily reproduce the problem and add logs and monitor configs in retina, or analyze the pcap file and look for things such as unfinished connections.

thegwan commented 1 hour ago

Two questions: 1) Is your pcap generated by taking a capture of a live traffic stream or built up from individual well-formed connections? If it is the former, I would expect many of the connections to have been cut-off before finishing. 2) When replaying, are you modifying the 4-tuple of each connection on each replay or is it simply a loop of the same pcap?