# Bro performance issues **URL:** \ **Category:** Zeek\ **Created:** [October 30, 2011, 9:46am UTC](https://community.zeek.org/t/bro-performance-issues/2082 "2011-10-30T09:46:16Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![William\_Jones](https://avatars.discourse-cdn.com/v4/letter/w/8dc957/32.png) [@William\_Jones](https://community.zeek.org/u/William_Jones)\ **Post date:** [November 2, 2011, 7:41pm UTC](https://community.zeek.org/t/bro-performance-issues/2082/21 "2011-11-02T19:41:29Z")
Try the following pcap filtering trick: ‘ [manager] type=manager host=localhost [proxy-1] type=proxy host=localhost [worker-1] type=worker host=localhost interface=em0 aux\_scripts=q1of2 [worker-2] type=worker host=localhost aux\_scripts=q2of2 Add the following scripts in share/bro/site q1of2.bro: redef restrict\_filters += { [“q0”] = “(ip[12:4] + ip[16:4]) & 1 == 0” }; q2of2.bro: redef restrict\_filters += { [“q0”] = “(ip[12:4] + ip[16:4]) & 1 == 1” }; ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [November 2, 2011, 7:58pm UTC](https://community.zeek.org/t/bro-performance-issues/2082/22 "2011-11-02T19:58:10Z")
Nice one! In the 2.0-beta you don't even need to define that aux\_scripts field either. You should be able to just make files named worker-1.local.bro and worker-2.local.bro in your \/share/bro/site/ directory and they will automatically get loaded by the correct nodes.   .Seth ---
**Author:** ![William\_Jones](https://avatars.discourse-cdn.com/v4/letter/w/8dc957/32.png) [@William\_Jones](https://community.zeek.org/u/William_Jones)\ **Post date:** [November 2, 2011, 9:31pm UTC](https://community.zeek.org/t/bro-performance-issues/2082/23 "2011-11-02T21:31:44Z")
Nice! ---
**Author:** ![William\_Jones](https://avatars.discourse-cdn.com/v4/letter/w/8dc957/32.png) [@William\_Jones](https://community.zeek.org/u/William_Jones)\ **Post date:** [November 2, 2011, 11:21pm UTC](https://community.zeek.org/t/bro-performance-issues/2082/24 "2011-11-02T23:21:09Z")
Something changed in the way packet filters work on 2.0 Bata bro. It does not seem to have the old behavior. What I wont is the ability to set a filter per work. That way I could write I could spread the tcp load for ip and iptv6 acros n works and run a n+1 work that take care of the no ip traffic. Bill Jones ---
**Author:** ![Martin\_Holste](https://avatars.discourse-cdn.com/v4/letter/m/dc4da7/32.png) [@Martin\_Holste](https://community.zeek.org/u/Martin_Holste)\ **Post date:** [November 3, 2011, 12:56am UTC](https://community.zeek.org/t/bro-performance-issues/2082/25 "2011-11-03T00:56:16Z")
Is there a reason you can't do PF\_RING? It's a lot more efficient than BPF load balancing. ---
**Author:** ![Tomer\_Teller](https://avatars.discourse-cdn.com/v4/letter/t/a87d85/32.png) [@Tomer\_Teller](https://community.zeek.org/u/Tomer_Teller)\ **Post date:** [November 3, 2011, 11:47am UTC](https://community.zeek.org/t/bro-performance-issues/2082/26 "2011-11-03T11:47:00Z")
Thanks for the tip William, This trick doesn’t work on Bro2.0 I tried both aux\_scripts and creating the worker-1.local.bro file I installed the new policy stop/start and again the workers are not load-balancing traffic tcpreplay -i ethX --mbps=1000.0 680000\_packets.pcap [BroControl] \> netstats worker-1: 1320349321.810072 recvd= **639496** dropped=30101 link=669597 worker-2: 1320349322.010123 recvd= **639549** dropped=30048 link=669597 This is Out of the box Bro2.0 with PF\_RING and libpcap compiles with PF\_RING. ---
**Author:** ![Martin\_Holste](https://avatars.discourse-cdn.com/v4/letter/m/dc4da7/32.png) [@Martin\_Holste](https://community.zeek.org/u/Martin_Holste)\ **Post date:** [November 3, 2011, 12:47pm UTC](https://community.zeek.org/t/bro-performance-issues/2082/27 "2011-11-03T12:47:21Z")
What's the output of cat /proc/net/pf\_ring/\* ? There should be a file per Bro worker in there when Bro is running. ---
**Author:** ![Tomer\_Teller](https://avatars.discourse-cdn.com/v4/letter/t/a87d85/32.png) [@Tomer\_Teller](https://community.zeek.org/u/Tomer_Teller)\ **Post date:** [November 3, 2011, 3:16pm UTC](https://community.zeek.org/t/bro-performance-issues/2082/28 "2011-11-03T15:16:58Z")
PF\_RING Version : 5.0.0 ($Revision: exported$) Ring slots : 4096 Slot version : 13 Capture TX : Yes [RX+TX] IP Defragment : No Socket Mode : Standard Transparent mode : Yes (mode 0) Total rings : 0 Total plugins : 0 [BroControl] \> status Name Type Host Status Pid Peers Started manager manager localhost running 13328 3 03 Nov 19:08:41 proxy-1 proxy localhost running 13359 3 03 Nov 19:08:43 worker-1 worker localhost running 13403 2 03 Nov 19:08:45 worker-2 worker localhost running 13402 2 03 Nov 19:08:45 [BroControl] \> netstats worker-1: 1320362018.486131 recvd=669511 dropped=286 link=669797 worker-2: 1320362018.686087 recvd=669650 dropped=147 link=669797 ---
**Author:** ![Martin\_Holste](https://avatars.discourse-cdn.com/v4/letter/m/dc4da7/32.png) [@Martin\_Holste](https://community.zeek.org/u/Martin_Holste)\ **Post date:** [November 3, 2011, 3:29pm UTC](https://community.zeek.org/t/bro-performance-issues/2082/29 "2011-11-03T15:29:04Z")
Ok, that shows that Bro is not in fact using PF\_RING, as there are no entries for the pids. ---
**Author:** ![William\_Jones](https://avatars.discourse-cdn.com/v4/letter/w/8dc957/32.png) [@William\_Jones](https://community.zeek.org/u/William_Jones)\ **Post date:** [November 3, 2011, 7:17pm UTC](https://community.zeek.org/t/bro-performance-issues/2082/30 "2011-11-03T19:17:18Z")
Is PF\_RING part of bro? ---
**Author:** ![William\_Jones](https://avatars.discourse-cdn.com/v4/letter/w/8dc957/32.png) [@William\_Jones](https://community.zeek.org/u/William_Jones)\ **Post date:** [November 3, 2011, 7:22pm UTC](https://community.zeek.org/t/bro-performance-issues/2082/31 "2011-11-03T19:22:15Z")
By studding the pcap filter code I found a work around. I set the “cmd\_linebpdf\_filter:” to my packfilter definition. It would be nice to have a more formal way to do this. ---
**Author:** ![William\_Jones](https://avatars.discourse-cdn.com/v4/letter/w/8dc957/32.png) [@William\_Jones](https://community.zeek.org/u/William_Jones)\ **Post date:** [November 3, 2011, 7:40pm UTC](https://community.zeek.org/t/bro-performance-issues/2082/32 "2011-11-03T19:40:06Z")
Don’t you need more foo to get PF\_RING to load balance it looks like you have to bind a bro instances to a cpu? ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [November 3, 2011, 7:48pm UTC](https://community.zeek.org/t/bro-performance-issues/2082/33 "2011-11-03T19:48:38Z")
Nope, and if you build Bro against the PF\_RING libpcap wrapper BroControl automatically takes care of everything to begin load balancing. I'm still waiting to hear back from Tomer with the output from the commands I asked him for earlier to actually figure out what's going wrong for him.   .Seth ---
**Author:** ![William\_Jones](https://avatars.discourse-cdn.com/v4/letter/w/8dc957/32.png) [@William\_Jones](https://community.zeek.org/u/William_Jones)\ **Post date:** [November 3, 2011, 8:27pm UTC](https://community.zeek.org/t/bro-performance-issues/2082/34 "2011-11-03T20:27:02Z")
Thank! I will give it a try! ---
**Author:** ![William\_Jones](https://avatars.discourse-cdn.com/v4/letter/w/8dc957/32.png) [@William\_Jones](https://community.zeek.org/u/William_Jones)\ **Post date:** [November 3, 2011, 9:30pm UTC](https://community.zeek.org/t/bro-performance-issues/2082/35 "2011-11-03T21:30:07Z")
I do bro mentoring with a tap. That means that each bro instances needs to read from two Ethernet interface to see tranmit and receive side the same tcp connection. The pcap filters insure that this happens. What happens when I use the PF\_RING pcap interface with bro. Will each bro worker see the same connection pair? ---
**Author:** ![Martin\_Holste](https://avatars.discourse-cdn.com/v4/letter/m/dc4da7/32.png) [@Martin\_Holste](https://community.zeek.org/u/Martin_Holste)\ **Post date:** [November 3, 2011, 10:10pm UTC](https://community.zeek.org/t/bro-performance-issues/2082/36 "2011-11-03T22:10:54Z")
Actually, I recommend setting up a bonded interface, which recent PF\_RING's will happily monitor. ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [November 4, 2011, 12:27pm UTC](https://community.zeek.org/t/bro-performance-issues/2082/37 "2011-11-04T12:27:31Z")
Ah, nice! Thanks for pointing that out.   .Seth ---
**Author:** ![William\_Jones](https://avatars.discourse-cdn.com/v4/letter/w/8dc957/32.png) [@William\_Jones](https://community.zeek.org/u/William_Jones)\ **Post date:** [November 4, 2011, 9:09pm UTC](https://community.zeek.org/t/bro-performance-issues/2082/38 "2011-11-04T21:09:12Z")
Just install bro with PF\_RING without my filter to see what happens with load pf\_ring load balancing. As I though the load balancing does a good jobs of distributing the load across my 8 bro workes. The down side is that bro is not working correctly sense each bro work only see part of the tcp connections for example the wired log: 1320440533.316479 B1zdmt0vxHf 129.114.13.51 54999 8.20.213.28 80 above\_hole\_data\_without\_any\_acks - F worker-2 1320440533.316479 F1NuRpLxmri 129.114.13.51 54999 8.20.213.28 80 above\_hole\_data\_without\_any\_acks - F worker-4 1320440533.316479 GBvErIhMFH3 129.114.13.51 54999 8.20.213.28 80 above\_hole\_data\_without\_any\_acks - F worker-1 1320440533.316479 Jgz4LByaW62 129.114.13.51 54999 8.20.213.28 80 above\_hole\_data\_without\_any\_acks - F worker-8 1320440533.316479 JgQfacLEqNf 129.114.13.51 54999 8.20.213.28 80 above\_hole\_data\_without\_any\_acks - F worker-5 1320440533.316479 a5JEFET8tid 129.114.13.51 54999 8.20.213.28 80 above\_hole\_data\_without\_any\_acks - F worker-6 1320440533.316479 Olp5WQZeFsk 129.114.13.51 54999 8.20.213.28 80 above\_hole\_data\_without\_any\_acks - F worker-7 There are a lot of other functions that don't seem to work. I am putting the filter back but I will continue to run pf\_ring with load blancing turned off and see what happens. ---
**Author:** ![William\_Jones](https://avatars.discourse-cdn.com/v4/letter/w/8dc957/32.png) [@William\_Jones](https://community.zeek.org/u/William_Jones)\ **Post date:** [November 5, 2011, 12:34am UTC](https://community.zeek.org/t/bro-performance-issues/2082/39 "2011-11-05T00:34:02Z")
I backed down from the PF\_RING pcap library. I couldn't find a way to run off the load balancing. ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [November 5, 2011, 1:23am UTC](https://community.zeek.org/t/bro-performance-issues/2082/40 "2011-11-05T01:23:04Z")
Hm, I'm not totally convinced that you have pf\_ring fully working yet. My guess is that each of those workers saw the same packet. Connection unique IDs will be generated differently on different hosts so you can't expect those to be the same and everything else, including the timestamp is exactly the same. Can you send the output of: broctl config | grep -i pfring and: ldd \/bin/bro If there is a problem with pf\_ring not being enabled correctly on some machines, we'd certainly like to figure it out. Thanks! .Seth [Previous page](https://community.zeek.org/t/bro-performance-issues/2082.md?page=1) [Next page](https://community.zeek.org/t/bro-performance-issues/2082.md?page=3)