FAQ - Is it possible for tcp dump to impact Aerospike transactions?
When using certain packet-tracing or system monitoring tools, the interfaces may be put into
promiscuous mode. In this mode, all packets are subject to filtering. One of the popular tools that has to put interfaces into the
promiscuous mode to function is
tcpdump, keep in mind that you may experience increased network latencies or dropped max throughput on the network interfaces.
Outside of running
tcpdump, there are other monitoring tools which may be putting interfaces in
promiscuous mode from time to time while gathering interface stats. Such monitoring tools must be avoided in order to ensure that the interfaces won’t exhibit spikes in latency/throughput issues. The below answer discusses how to check if interfaces are and whether they have been put in
The easiest way to check if an interface is currently in promisc mode is by running the following command:
[root@localhost ~]# netstat -i Kernel Interface table Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg eth0 1500 0 2075 0 0 0 1370 0 0 0 BPRU lo 16436 0 1985 0 0 0 1985 0 0 0 LRU
The flags section contains the
P flag, which means the interface is currently in promiscuous mode.
Alternatively, this can be checked using
ifconfig, see the flags section contains
PROMISC flag printed:
# ifconfig eth0 eth0 Link encap:Ethernet HWaddr xx:xx:xx:xx:xx:xx inet addr:126.96.36.199 Bcast:255.255.255.255 Mask:255.255.0.0 UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1 RX packets:22685771 errors:0 dropped:83424 overruns:0 frame:0 TX packets:13461 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:1604651517 (1.4 GiB) TX bytes:1475694 (1.4 MiB)
To check for historical states, have a look at
$ dmesg |grep promisc Nov 14 07:53:49 test kernel: device eth0 entered promiscuous mode Nov 14 07:54:03 test kernel: device eth0 left promiscuous mode Nov 14 07:54:49 test kernel: device eth0 entered promiscuous mode Nov 14 07:55:03 test kernel: device eth0 left promiscuous mode Nov 14 07:55:49 test kernel: device eth0 entered promiscuous mode Nov 14 07:56:03 test kernel: device eth0 left promiscuous mode
As can be seen, the device eth0 has entered and exited promiscuous mode. This line is seen repeating every minute, indicating this is done by either a cron job or a monitoring software. Cron and any monitoring processes must be checked to ensure the interface is NOT put in promiscuous mode. In this example, every time the interface enters promiscuous mode, our machine has max throughput decreased by about 30%.
Promiscuous mode may be forced to the ‘off’ position (although it will go back to ‘on’ if requested to do so):
# ip link set [interface] promisc off
TCPDUMP PROMISCUOUS MODE PROMISC LATENCY THROUGHPUT