I’m trying to debug some packet drops that I’m experiencing and am turning to the list for help. The recorded packet loss is ~50 – 70% at times. The packet loss is recorded in broctl’s netstats as well as in the notice.log file. Running netstats at startup – I’m dropping more than I’m receiving fro…

Some thoughts inline... I’m trying to debug some packet drops that I’m experiencing and am turning to the list for help. The recorded packet loss is ~50 – 70% at times. The packet loss is recorded in broctl’s netstats as well as in the notice.log file. Running netstats at startup – I’m droppi…

Thanks Mike - I’m using 16 workers because the ixgbe 10gb nic support hardware receive side scaling. 16 is the max number of queues that it supports. While trying to monitor traffic this afternoon, I was seeing ~700 - 800mb/s based on pfcount stats. If I disabled the hardware RSS I’d have to switc…

Thanks Gary. Sorry to top post, I'm stuck on OWA at the moment. Thanks for your suggestions - here are some quick replies: - capture_loss.bro - running it, every 15min it reports ~70% packet loss (or greater) across all of the workers - 'adapters_to_enable' ixgbe.ko argument doesn't exist in t…

Ah, I’m still on 6.0.3 with DNA/Libzero, so didn’t realize that adapters_to_enable was changed/removed. I’m about to start testing 6.2 with ZC soon, but probably using zbalance_ipc instead of relying on RSS. If you are running into RSS limits, but have more cores on another socket using zbalance_ipc…

If you make the line “interface=zc:eth3”, the pf_ring plugin for broctl should automatically change the interface that each Bro process is sniffing to the correct name as you’ve indicated (zc:eth3@[0-15]). Configure it that way and the check with ps what interface is being sniffed (you will see i…

Thanks Seth - I have my node.cfg to point to zc:eth3 interface=zc:eth3 Upon running broctl cleanup/deploy, I’m seeing that bro is called with only "-i zc:eth3”. I tried calling it with “zc:2” (cluster ID) and zbalance_ipc handed out 8k packets before the bro workers crashed. -Paul

Oh! I forgot, that’s the right way to use it. I forgot about the cluster ID thing. Forget what I said before. :slight_smile: Could you send me a log from Bro crashing (hopefully you got a stack trace in your crash dump from broctl)? That could be some unrelated problem. .Seth

That last bit about only processing 8k packets sounds almost like PF_RING might be stuck in demo mode for ZC (runs for 10 secs or so) and then stops. This could mean that PF_RING isn't seeing your license file. Any chance it can't read the files in /etc/pf_ring/ or that there is a PATH problem somew…

Did you check that the broctl config option "pfringclusterid" has a non-zero value? broctl config | grep pfring You can also check that broctl is using the correct interface name by looking at the "interface=" field in the output of the following command: broctl nodes

Bro Packet Loss / 10gb ixgbe / pf_ring

Zeek

Mike_Reeves January 7, 2016, 10:15pm 2

Change your min_num_slots to be 65535. I would add an additional proxy as well as an additional 8 workers.

Topic		Replies	Views
Bro 2.0 packets dropped Zeek	22	418	May 6, 2022
bro and pf_ring zc configuration success stories Zeek	18	598	May 6, 2022
Bro performance issues Zeek	53	508	May 6, 2022
Packet Drops Zeek	20	172	May 6, 2022
Bro workers die Zeek	8	122	May 6, 2022

Bro Packet Loss / 10gb ixgbe / pf_ring

Related topics