af_packet/pf_ring equivalency

I am using pf_ring with pfcount to do traffic analysis (pps/throughput) since it is very reliable.

Does af_packet have an equivalent for this? I dont want to use broctl capstats unless there is absolutely no other option.

ifpps for generic bandwidth and pps monitoring. Never, ever, use iptraf. ifpps has been written by the netsniff-ng author and it speaks for itself.

bwm-ng seems to be good, haven’t compared the accuracy and the perf data acquisition.

For monitoring drops

ethtool -S to detect drops in card’s FIFO and sometimes, reasons for them.

to detect drops at the softirq layer

Bro’s stats.log to detect drops at the af_packet layer

Bro capture_loss to detect drops in all above + drops before packets reach your sensor.

Monitoring drops is complex and there is no single metric that tells you all. Some of this is true for pfring as well, people just don’t know. I’ve seen sensors with 2-3% drops (in Suricata) but 40% drops in FIFO and they were like “we’re doing fine”. Well, so here’s a bad news… :wink:

Interestingly, bwm-ng does not give me traffic numbers for my sniff interface… I am trying to get ifpps, but I dont want to have to compile it and would like to find a rhel6 package of it. Sadly, it isnt in EPEL’s netsniff-ng package group.

The documentation for installing netsniff-ng is not great so I don’t blame you, however, it’s not all that bad if you just run the one liner to install all the dependancies for your respective distro and then compile/build just ifpps using the following:

One-liner installation for all dependencies on Debian:

$ sudo apt-get install ccache flex bison libnl-3-dev
libnl-genl-3-dev libnl-route-3-dev libgeoip-dev
libnetfilter-conntrack-dev libncurses5-dev liburcu-dev
libnacl-dev libpcap-dev zlib1g-dev libcli-dev libnet1-dev

One-liner installation for all dependencies on Fedora:

$ sudo yum install ccache flex bison ccache libnl3-devel
GeoIP-devel libnetfilter_conntrack-devel ncurses-devel
userspace-rcu-devel nacl-devel libpcap-devel zlib-devel
libcli-devel libnet-devel

Compile/build options:

sudo make ifpps
sudo make ifpps_install

OR (I’d recommend this if you want more tools but the tunneling stuff, FYI it also creates dependency issues [at least on Fedora based distros] so exclude it using this)

sudo make allbutcurvetun
sudo make install_allbutcurvetun