Project

General

Profile

Actions
Copy link

Optimization #3637

closed

Performance impact of Cisco Fabricpath

Added by Andreas Herz over 4 years ago. Updated over 1 year ago.

Status:
Closed
Priority:
Normal
Assignee:
Philippe Antoine
Target version:
7.0.1
Effort:
Difficulty:
Label:

Description

At some setups we see Cisco Fabricpath Traffic (ethertype 0x8903) that results in rather high drop rates even though the traffic is not responsible for much load. With a bpf filter to that protocol the issue was gone.

Files

Download all files
813_a.txt (7.68 KB) 813_a.txt Andreas Herz, 04/14/2020 03:35 PM
813_b.txt (7.66 KB) 813_b.txt Andreas Herz, 04/14/2020 03:35 PM
d11_a.txt (7.6 KB) d11_a.txt Andreas Herz, 04/14/2020 03:35 PM
d11_b.txt (7.35 KB) d11_b.txt Andreas Herz, 04/14/2020 03:35 PM
perftop.png (28.5 KB) perftop.png Andreas Herz, 04/14/2020 03:35 PM

Subtasks 1 (0 open — 1 closed)

Optimization #6229: Performance impact of Cisco Fabricpath (6.0.x backport)ClosedPhilippe AntoineActions

Related issues 1 (0 open — 1 closed)

Related to Suricata - Bug #6394: Sudden increase in capture.kernel_drops and tcp.pkt_on_wrong_thread after upgrading to 6.0.14ClosedPhilippe AntoineActions
Actions
Copy link
 #1

Updated by Victor Julien over 4 years ago

Do you have more info about what you're seeing? Any decoder events, perf stats, etc?

Actions
Copy link Download all files
 #2

Updated by Andreas Herz over 4 years ago

Two systems with no filter active (case a) and bpf filter active (case b). Also a perf top from those machines running without the bpf filter. The left one is another machine with low traffic and not that much traffic at all but quite some amount of it being cisco fabric path.

Actions
Copy link
 #3

Updated by Peter Manev over 4 years ago

Out of curiosity - any chance of knowing whats the "unknown" function on top of the leftmost pertop?

Actions
Copy link
 #4

Updated by Andreas Herz over 4 years ago

Peter Manev wrote in #note-3:

Out of curiosity - any chance of knowing whats the "unknown" function on top of the leftmost pertop?

I didn't had a change to find it yet, when I zoom in I see nothing. I agree that this is rather strange.

Actions
Copy link
 #5

Updated by Peter Manev over 4 years ago

Btw - there are some functions/calls that can be unknown , just havn't seen an "unknown" with so high usage - was my point.

Actions
Copy link
 #6

Updated by Philippe Antoine over 1 year ago

  • Status changed from New to In Review
  • Assignee set to Philippe Antoine
  • Target version changed from TBD to 8.0.0-beta1
Actions
Copy link
 #7

Updated by Philippe Antoine over 1 year ago

  • Target version changed from 8.0.0-beta1 to 7.0.1
Actions
Copy link
 #8

Updated by Philippe Antoine over 1 year ago

  • Priority changed from Low to Normal
Actions
Copy link
 #9

Updated by Philippe Antoine over 1 year ago

  • Label Needs backport, Needs backport to 6.0 added
Actions
Copy link
 #10

Updated by Victor Julien over 1 year ago

  • Status changed from In Review to Resolved
Actions
Copy link
 #11

Updated by OISF Ticketbot over 1 year ago

  • Subtask #6229 added
Actions
Copy link
 #12

Updated by OISF Ticketbot over 1 year ago

  • Label deleted (Needs backport, Needs backport to 6.0)
Actions
Copy link
 #13

Updated by Victor Julien over 1 year ago

  • Status changed from Resolved to Closed
Actions
Copy link
 #14

Updated by Victor Julien about 1 year ago

  • Related to Bug #6394: Sudden increase in capture.kernel_drops and tcp.pkt_on_wrong_thread after upgrading to 6.0.14 added
Actions
Copy link

Also available in: Atom PDF