Truncated in RX_RING

vladzz

The Rat tool is really awesome. We are running Trisul in online_rxring mode and there are a lot of 'truncated' packets. This is an Intel Gigabit Card seeing around 350Mbps. I have attached a ss below

truncated

Does this mean we are seeing packet drops as truncated?

vladzz

how to attach a screenshot??? help

admin

Can you post on image sharing site and put the URL here ? This is how flarum (this forum) supports image uploads.

for example
- paste image into postimg.org
- put the link using markdown like this ![image caption](http://postimg.org/alsdjlsa)

vladzz

trying it out

See the Truncated items in RAT

test

admin

Vlad -

You get the TRUNCATED entries when the following happens.

In RX_RING Mode ( basically TPACKET_V2 ) each "frame" is of a fixed size - this maps to a packet. In Trisul-Probe for example this is 8K or so. When packets are larger that 8K, we only capture the first 8K and increment the TRUNCATED counter.

Now why are ethernet packets greater than 8K, the reason is due to Hardware Offload on Gig E/ 10G cards. The normal suggestion is

turn off TCP Segmentation Offload (tso)
turn off Generic Segmentation Offload (gso)

using the following

ethtool -K eth2 tso off
ethtool -K eth2 gso off

But you also need to turn off Generic Receive Offload ! This is on newer kernels that replaces the LRO (Large Receive Offload) I am not sure your card has this - but the INTEL PRO 1000's do support this option. Check the gro and turn that off too

ethtool -K eth2 gro off

If this is available , it should stop the TRUNCATED. Yes, these indicate packet loss because Trisul does not feed Truncated packets into the TCP Reassembly engines.

Thanks

Vivek

vladzz

Thanks ethtool gro off worked.