1

I am migrating a packet sniffing project from a Dell PowerEdge R410 (with dual Broadcom 1Gb integrated NICs) to a Dell PowerEdge R620 (with quad Intel 1521 i350-series 1Gb daughterboard NICs). I am running the exact same code on the same OS (Debian Squeeze) on both systems. I'm experiencing a problem on the R620 where libpcap is able to retrieve all packets from the Intel NIC, but our software cannot get them from libpcap callback quickly enough and are dropped. The R410 does not report any dropped packets in this same scenarkio. Is it possible that there is a NIC driver setting or flag that could cause such behavior on the Intel NIC? Has anyone else experienced this sort of problem and have any insights on how to go about fixing it?

Also, as a sanity check test, I downloaded and used Tim Carsten's example sniffex.c program (http://www.tcpdump.org/pcap.html) and ran it on both machines. The R410 did not lose packets, but the R620 did.

Improve this question
4
  • 2
    There's a bunch of interrupt coalescing code for the intel nic which can cause this problem as you're not being fed the packets in small enough chunks to process. Try setting the InterruptThrottleRate, RXIntDelay and RXAbsIntDelay (they're per port settings)
    – Anya Shenanigans
    Feb 11, 2013 at 17:07
  • @Petesh's answer sounds compelling. Does that help you at all?
    – allquixotic
    Feb 11, 2013 at 20:42
  • I took another look at the Intel driver (version 4.1.2) and found the InterruptThrottleRate. I could not find the RXIntDelay and RXAbsIntDelay parameters. I adjusted the InterruptThrottleRate up, down, and even turned it off but I am still losing packets.
    – bbs_chad
    Feb 11, 2013 at 21:53
  • InterruptThrottleRate=0,0,0,0 is the tunable to use (based on intel.com/support/network/adapter/pro100/sb/CS-032498.htm). Does tcpdump miss the packets? Have you checked interrupt allocation for the i350 driver?
    – Anya Shenanigans
    Feb 12, 2013 at 11:54

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .