Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

客户生产环境pktminerg采集数据包,出现乱序问题 #166

Closed
tttccabc opened this issue Jul 9, 2024 · 3 comments
Closed

客户生产环境pktminerg采集数据包,出现乱序问题 #166

tttccabc opened this issue Jul 9, 2024 · 3 comments

Comments

@tttccabc
Copy link

tttccabc commented Jul 9, 2024

回复_ 关于云下PA流量采集验证解码的进度沟通.pdf
Pktminerg版本截图

问题说明:生产环境部署PA,cpm下发采集任务,pktminerg进行流量采集,通过zmq发送到bpc接收,数据包间歇性存在乱序,由于数据包是tls加密,乱序后导致BPC无法解出交易。

为什么说是pktminerg采集问题?
现场做过判断:目标服务器流量2-4Mbps;
》 有gigamon TAP做了镜像;
pktminerg有两个采集任务:》1采集存储包本地;
》2采集zmq送到bpc,probe_recv接收存储。

通过对比上面3个采集pcap数据包,结论是tap镜像方式,数据包完整无乱序,无丢包; pktminerg采集的2种方式结果一致,都存在乱序。

附件说明:

  1. 附件pdf,是现场采集结果对比邮件截图。
  2. 现场pktminer版本截图。
Copy link

github-actions bot commented Jul 9, 2024

Message that will be displayed on users first issue

@robbietu
Copy link
Contributor

robbietu commented Jul 9, 2024

此问题需要进一步的验证和调研。

@robbietu robbietu closed this as completed Jul 9, 2024
@rivercg
Copy link
Contributor

rivercg commented Jul 18, 2024

通过和 @tttccabc 进一步沟通,发现问题现场采用 tcpdump (libpcap版本为1.8) 抓包,同样有乱序问题,而且数据与 CloudProbe 一致 (libpcap版本为1.5.3)。而CP侧可能的改进就是升级libpcap版本。

因此,需要现场通过升级 tcpdump 版本(同时升级了libpcap版本)来验证修改libpcap能够解决该问题,CP才会进一步处理。

当前先关闭该问题,等待验证可行后,再reopen本问题。

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants