# bro and pf\_ring zc configuration success stories

**URL:** <https://community.zeek.org/t/bro-and-pf-ring-zc-configuration-success-stories/5034>\
**Category:** Zeek\
**Created:** [September 26, 2017, 10:07pm UTC](https://community.zeek.org/t/bro-and-pf-ring-zc-configuration-success-stories/5034 "2017-09-26T22:07:24Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![radek](https://avatars.discourse-cdn.com/v4/letter/r/e19adc/32.png) [@radek](https://community.zeek.org/u/radek)\
**Post date:** [September 26, 2017, 10:07pm UTC](https://community.zeek.org/t/bro-and-pf-ring-zc-configuration-success-stories/5034/1 "2017-09-26T22:07:24Z")

</div>

Hi!

Anyone care to share bro + pfring success story?

What’s the speed, what NIC, what’s the configuration.

I’m running bro 2.5.1 built with jemalloc and gperftools and against pf\_ring 6.6.0 with ixgbe\_zc on CentOS 7.2.

In ZeroCopy mode with zbalance\_ipc dividing NIC to 20 application rings (-n 20) I’m getting each CPU core loaded at 100% and around 50% packet drop (reported by netstats in broctl).

When redirecting from zc to 20 dummy interfaces (zbalance\_ipc -r 0:dummy0 and so on) I’m getting around 50% load on each core and a lot less of packet drop (10% - 15%).

This is with traffic around 700 - 800 Mbit/s

All input will be highly appreciated.

Best regards  
Rado

---

_[View the full topic](https://community.zeek.org/t/bro-and-pf-ring-zc-configuration-success-stories/5034)._
