L3HW traffic monitoring

[mikronoob89]

Hi dears.
Partial noon here

I implemented the L3HW on the CCR2216. It works great! My CPU dropped to near zero percent from 72 percent!!

But now I lost the ability to monitor my subinterface traffics. I work in an ISP and is mandatory for me to monitor my traffic on “per-user” basis.

I have only one 100G interface for both up and downstream traffic.

I tried mirroring the traffic to CPU. Then the monitoring works, but the CPU goes up again. What’s the solution for this?

[mkx]

There is no solution for this. L3HW offload implementation doesn’t provide any detailed statistics, so if you need it, then … well, you unfortunately can’t use L3HW offload.

[raimondsp]

Hi,

What’s the problem with mirroring? It increases CPU usage since packets enter the CPU. However, unlike the software routing, the CPU does not throttle the performance in the case of mirroring. For instance, if the CPU can handle 10G while the actual traffic rate is 50G, all 50G will get hardware-routed while only 10G gets mirrored to the CPU (the rest is tail-dropped from CPU queues). But if you need to monitor 100% traffic, then I see no other way but disabling L3HW and throttling bandwidth down to the CPU capabilities.

[nz_monkey]

Hi raimondsp

Hardware level traffic sampling on the Marvell ASIC’s to netflow/sflow would be the optimal solution, to quote you "Hardware traffic sampling and QoS are the next major features that we consider implementing after the finalization of IPv6 L3HW. "

Is this still on the high priority list ?

It will allow exporting of flow information to DDoS systems well as well as flow accounting systems like nfacct that are widely used.

[mikronoob89]

Hi,

What’s the problem with mirroring? It increases CPU usage since packets enter the CPU. However, unlike the software routing, the CPU does not throttle the performance in the case of mirroring. For instance, if the CPU can handle 10G while the actual traffic rate is 50G, all 50G will get hardware-routed while only 10G gets mirrored to the CPU (the rest is tail-dropped from CPU queues). But if you need to monitor 100% traffic, then I see no other way but disabling L3HW and throttling bandwidth down to the CPU capabilities.

Hi. Sorry for late reply. I didn’t check the email

I tried mirroring it too. The CPU went to 70% again. I don’t get it.

[mikronoob89]

There is no solution for this. L3HW offload implementation doesn’t provide any detailed statistics, so if you need it, then … well, you unfortunately can’t use L3HW offload.

Hi.

Dear, do you know if it is on the “to-do list” of Mikrotik developers?

[raimondsp]

Hi raimondsp

Hardware level traffic sampling on the Marvell ASIC’s to netflow/sflow would be the optimal solution, to quote you "Hardware traffic sampling and QoS are the next major features that we consider implementing after the finalization of IPv6 L3HW. "

Is this still on the high priority list ?

It will allow exporting of flow information to DDoS systems well as well as flow accounting systems like nfacct that are widely used.

Hey there,

We are currently finalizing hardware QoS implementation. I wouldn’t say traffic sampling is the next big feature in line, but it is on the roadmap.

[nz_monkey]

Hey there,

We are currently finalizing hardware QoS implementation. I wouldn’t say traffic sampling is the next big feature in line, but it is on the roadmap.

Thanks raimondsp, it is great to know it is on the roadmap.

[jtommasi]

Hi raimondsp

Hardware level traffic sampling on the Marvell ASIC’s to netflow/sflow would be the optimal solution, to quote you "Hardware traffic sampling and QoS are the next major features that we consider implementing after the finalization of IPv6 L3HW. "

Is this still on the high priority list ?

It will allow exporting of flow information to DDoS systems well as well as flow accounting systems like nfacct that are widely used.

Hey there,

We are currently finalizing hardware QoS implementation. I wouldn’t say traffic sampling is the next big feature in line, but it is on the roadmap.

Hi there,

Is there any news about traffic flow for L3HW ?

[wahezu]

Hey,

Any news regarding netflow reporting while using HW offload?