The Rat tool is really awesome. We are running Trisul in online_rxring mode and there are a lot of 'truncated' packets. This is an Intel Gigabit Card seeing around 350Mbps. I have attached a ss below

truncated

Does this mean we are seeing packet drops as truncated?

    how to attach a screenshot??? help

      Can you post on image sharing site and put the URL here ? This is how flarum (this forum) supports image uploads.

      for example
      - paste image into postimg.org
      - put the link using markdown like this ![image caption](http://postimg.org/alsdjlsa)

        trying it out

        See the Truncated items in RAT

        test

          Vlad -

          You get the TRUNCATED entries when the following happens.

          In RX_RING Mode ( basically TPACKET_V2 ) each "frame" is of a fixed size - this maps to a packet. In Trisul-Probe for example this is 8K or so. When packets are larger that 8K, we only capture the first 8K and increment the TRUNCATED counter.

          Now why are ethernet packets greater than 8K, the reason is due to Hardware Offload on Gig E/ 10G cards. The normal suggestion is

          • turn off TCP Segmentation Offload (tso)
          • turn off Generic Segmentation Offload (gso)

          using the following

          ethtool -K eth2 tso off
ethtool -K eth2 gso off

          But you also need to turn off Generic Receive Offload ! This is on newer kernels that replaces the LRO (Large Receive Offload) I am not sure your card has this - but the INTEL PRO 1000's do support this option. Check the gro and turn that off too

          ethtool -K eth2 gro off

          If this is available , it should stop the TRUNCATED. Yes, these indicate packet loss because Trisul does not feed Truncated packets into the TCP Reassembly engines.

          Thanks

          Vivek

            7 days later

            Thanks ethtool gro off worked.

              Write a Reply...