rootninja

If your network is very active and package capture is struggling to keep up, dropping packets every now and then, you could try changing the buffer size.

I’m using the e1000e driver,

# ethtool -i eth0

driver: e1000e
version: 0.3.3.3-k4
firmware-version: 1.1-1
bus-info: 0000:00:19.0

and I can’t set/display coalesce parameters

# ethtool -c eth0

Coalesce parameters for eth0:
Cannot get device coalesce settings: Operation not supported

But you can set it in /etc/modprobe.conf

options e1000 InterruptThrottleRate=8000

My default configuration sets InterruptThrottleRate to Mode 1 which is for dynamic interrupt coalescing. Intel’s ap450 documentation mentions this will allow it to change between bulk, low latency, and lowest latency as network traffic patterns change. Changing this to a fixed value for bulk may decrease latency. Intel shows bulk as 4000 and low latency as 20000. I’ll start with 4000 and test it with increasing values.

# lspci | grep Giga

01:0c.0 Ethernet controller: Intel Corporation 82540EM Gigabit Ethernet Controller (rev 02)

To display current settings for your network interface, use ethtool.

# ethtool -g eth0

Ring parameters for eth0:
Pre-set maximums:
RX:             4096
RX Mini:        0
RX Jumbo:       0
TX:             4096
Current hardware settings:
RX:             256
RX Mini:        0
RX Jumbo:       0
TX:             256

I’ll try testing with the RX set to the max.

# ethtool -G eth0 rx 4096

If your network host bus adapter is a PCI device, you could also try lowering the latency in the BIOS settings. All the default settings i’ve seen have it set to 64 and you can lower it to 32. This is done for the whole bus, not per device.

And I read somewhere I can set net.core.netdev_max_backlog to a higher value to increase the buffer so i’ll give that a try. (I think I saw this on the Bro NIDS website) but now i’m thinking it might apply only to FreeBSD?

# sysctl -w net.core.netdev_max_backlog=2048

I think the RX size might increase the overall latency. Perhaps just the backlog setting would do the trick. But i’ll try that later. If this doesn’t stop the packet loss, i’ll look at libpcap and the kernel since I am running a generic kernel.