Existing MTP Hardware Filters were working successfully with TIM receiving expected network packets and monitoring applications. However after expansion of those filters to add more IP Addresses problems started to occur but no errors received during the change:
- The TIM has stopped monitoring applications.
- The TIM is not receiving expected network packets as confirmed by the 5 minute Packet Statistics page and logs/protocolstats *.csv files i.e. pkts-capture is very high but pkts-forward is very low
TIM running under MTP
These types of log file error will be seen:
20160804-10:32:41 mtpCaptureTrap - ERROR: Error setting hardware filter 'xxxx' for logical port 0.
20160804-10:32:41 Trap not sent. No trap destination configured.
10:42:59 Feed 0, Filter 7, Name 'xxxxx', Port Mask 01, Priority 10
10:42:59 Command: Capture[Feed=0;Priority=10]=((((mIPSrcAddr==[...],...OR mIPDestAddr==[...]...) AND (mTCPSrcPort==443 OR mTCPDestPort==443)) AND (mIPv4Protocol==6)) AND Channel==0)
10:42:59 * * * Error: Internal error
There are restrictions based on the number of items that can be specified on a single hardware filter. There is also a limit on the total number of hardware filters across all logical ports based on hardware resources. However determining that limit is not straightforward and it is usually based on trial and error.
Information about the current number of hardware filter resources currently being used can be found by logging into Linux using the netqos account and performing the following command while the nqcapd process is running:
sudo /opt/napatech/bin/NtplTool -expr "FilterInfo=All"
This gives the count of the various hardware resources being used. Note that the values are given in hex.
The following table gives the limits for each type.
Note: most of the MTP filters use the PatternCount in conjunction with the Group4PlusCount and Group8Count.
Parameter Max Value (hex)
SizeCount => 0x02
ProtocolCount => 0x08
ErrorCount => 0x08
PatternCount => 0x40
DynOffsetCount => 0x04
Group4PlusCount => 0x20
Group8Count => 0x20
SliceLookupCount => Unlimited (64)
SliceLengthCount => Unlimited (64)
SearchCount => n/a n/a
The workaround for this problem is to create a second hardware filter for the same logical port to specify additional items (e.g. IP addresses).
Not Seeing Traffic. Is the issue on the MTP or TIM side?