# Capture Loss **URL:** \ **Category:** Zeek\ **Created:** [March 7, 2017, 3:34pm UTC](https://community.zeek.org/t/capture-loss/4709 "2017-03-07T15:34:23Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Arash\_Fallah](https://avatars.discourse-cdn.com/v4/letter/a/45deac/32.png) [@Arash\_Fallah](https://community.zeek.org/u/Arash_Fallah)\ **Post date:** [March 7, 2017, 3:34pm UTC](https://community.zeek.org/t/capture-loss/4709/1 "2017-03-07T15:34:23Z")
I’m running Bro in a clustered configuration using PF\_RING to have 8 separate workers on one box. Additionally, I have commented out almost everything in the default local.bro to run in Bro as efficiently as possible. Together, these 8 workers are using less than 20% of total CPU capacity. However, we are experiencing capture loss consistently in the 50% range, even though CPUs are idle 80% of the time on average. Does anyone have any experience with this? I would greatly appreciate the help. ---
**Author:** ![Drew\_Dixon](https://avatars.discourse-cdn.com/v4/letter/d/bcef8e/32.png) [@Drew\_Dixon](https://community.zeek.org/u/Drew_Dixon)\ **Post date:** [March 9, 2017, 9:27pm UTC](https://community.zeek.org/t/capture-loss/4709/2 "2017-03-09T21:27:55Z")
Did you search the email list already or did you just join the list? Are you capturing the traffic from a SPAN port or a Tap? Is your network full of asymmetrical traffic/routing? Answers to these two questions first is pretty important IMO. I responded to a very similar question around 6 days ago or so on list…here’s what I said again: ---
**Author:** ![Arash\_Fallah](https://avatars.discourse-cdn.com/v4/letter/a/45deac/32.png) [@Arash\_Fallah](https://community.zeek.org/u/Arash_Fallah)\ **Post date:** [March 14, 2017, 9:47pm UTC](https://community.zeek.org/t/capture-loss/4709/3 "2017-03-14T21:47:27Z")
Hey Drew, I’ve been on the list for over a year, I tried searching to see similar issues but I didn’t find it. We are capturing from a span port, we have 3 edge routers and tons of asymmetrical routing. We are experiencing packet loss at such a high rate, we believe the error might be upstream (thanks to Seth)! We are going to try passive taps instead of capturing from SPAN ports. PF\_RING is installed with DKMS. All offloading has been disabled and I have been checking reporter.log for invalid checksums (none so far). CPU pinning is enabled. Though I did I did not know about ring slots for PF\_RING, I do not think our network at 3Gbps requires increasing the threshold from my research. Thanks so much, you were on point with your questions. ---
**Author:** ![Drew\_Dixon](https://avatars.discourse-cdn.com/v4/letter/d/bcef8e/32.png) [@Drew\_Dixon](https://community.zeek.org/u/Drew_Dixon)\ **Post date:** [March 15, 2017, 2:49am UTC](https://community.zeek.org/t/capture-loss/4709/4 "2017-03-15T02:49:17Z")
Glad to hear you’re now on the right track! You’re very welcome. FWIW I think the other person on the other similar thread I copied my reply from might not have known about installing PF\_RING with DKMS so wanted to cover possible kernel module issues etc… I was going to guess your issue was upstream based on what you described in your first email but I didn’t want to speculate too much heh. Taps are def. the way to go if you have the option to use them instead of SPAN ports, for sure. Best regards, -Drew ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/capture-loss/4709/5 "2022-05-06T15:44:42Z")