# Bro 2.6.1 packet loss

**URL:** https://community.zeek.org/t/bro-2-6-1-packet-loss/5594
**Category:** Zeek
**Created:** [January 23, 2019, 6:03pm UTC](https://community.zeek.org/t/bro-2-6-1-packet-loss/5594 "2019-01-23T18:03:47Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![C\_Blair](https://avatars.discourse-cdn.com/v4/letter/c/8baadc/32.png) [@C\_Blair](https://community.zeek.org/u/C_Blair)
#### Post date: [January 23, 2019, 6:03pm UTC](https://community.zeek.org/t/bro-2-6-1-packet-loss/5594/1 "2019-01-23T18:03:47Z")

</div>

We are testing the latest release on our sensors and are seeing larger packet drops than the previous 2.5.5.

We are running a local cluster with the following

node.cfg:  
[manager]  
localhost

[logger]  
localhost

[proxy-1]  
localhost

[worker-1]  
localhost  
lb\_method = pf\_ring  
lb\_procs = 20  
pin\_cpus = 0-19

System:  
Xeon D-1587 16 cores, 32 logical, 1.7 Ghz  
128GB DDR4 2133Mhz  
8TB SSD  
Intel 10GBase-T X557

We are dropping traffic @ 250 Mb/s with this config. We have already tuned the BIOS, NIC and sysctl.d. Did the netstats command get updated in the latest release? We did not see this poor performance with bro 2.5.5. Can you provide any other suggestions?

Also, did the pf\_ring plugin get removed?

R,  
CB

---

<div class="post-metadata">

### Author: ![Edgmand\_Craig](https://avatars.discourse-cdn.com/v4/letter/e/838e76/32.png) [@Edgmand\_Craig](https://community.zeek.org/u/Edgmand_Craig)
#### Post date: [January 23, 2019, 6:16pm UTC](https://community.zeek.org/t/bro-2-6-1-packet-loss/5594/2 "2019-01-23T18:16:25Z")

</div>

You have to use bro-pkg manager to get the pf\_ring plugin now.

---

<div class="post-metadata">

### Author: ![seth](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/seth/32/642_2.png) [@seth](https://community.zeek.org/u/seth)
#### Post date: [January 24, 2019, 2:37pm UTC](https://community.zeek.org/t/bro-2-6-1-packet-loss/5594/3 "2019-01-24T14:37:25Z")

</div>

Is this your actual configuration? I don't even see an interface to sniff, and where you've specified "localhost" seems to not have the associated configuration key.

Based on your question about pf\_ring too, it sounsd like you might not actually be load balancing your traffic. Are you having duplicate logs?

&nbsp;&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

### Author: ![C\_Blair](https://avatars.discourse-cdn.com/v4/letter/c/8baadc/32.png) [@C\_Blair](https://community.zeek.org/u/C_Blair)
#### Post date: [January 29, 2019, 4:10pm UTC](https://community.zeek.org/t/bro-2-6-1-packet-loss/5594/4 "2019-01-29T16:10:00Z")

</div>

Hi Seth,

Thank you for the response. It is my configuration. eth0 is the capture interface. I figured out the issue based on your duplicate log question.

In node.cfg, when using lb\_method=pf\_ring, i belive the cluster ID is supposed to be automatically assigned. If you look at the output of “broctl config” it shows pfringclusterid = 21, however, that is not the case. I had to explicitly assign the cluster ID in broctl.cfg like this:

pfringclusterid = 21

This might be good to include in the documentation here: [https://www.zeek.org/documentation/load-balancing.html](https://www.zeek.org/documentation/load-balancing.html)

Thanks again,  
CB

---

<div class="post-metadata">

### Author: ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/bro-2-6-1-packet-loss/5594/5 "2022-05-06T15:46:18Z")

</div>