# Dropped packets in PF\_RING install **URL:** \ **Category:** Zeek\ **Created:** [August 29, 2014, 4:03pm UTC](https://community.zeek.org/t/dropped-packets-in-pf-ring-install/3248 "2014-08-29T16:03:33Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Nicholas\_SIow](https://avatars.discourse-cdn.com/v4/letter/n/46a35a/32.png) [@Nicholas\_SIow](https://community.zeek.org/u/Nicholas_SIow)\ **Post date:** [August 29, 2014, 4:03pm UTC](https://community.zeek.org/t/dropped-packets-in-pf-ring-install/3248/1 "2014-08-29T16:03:33Z")
Hi Bro, We have an install of bro running on a single machine with PF\_RING load balancing. Previously we were seeing a huge amount of dropped traffic — in the realm of ~90% average packet loss per hour. The history column in our `conn.log` was trash as expected, with only one or two letters per connection. After some tweaking (adding memory & upping # of bro processes & changing PF\_RING buffer size), the logs look much better and the packet loss is drastically reduced, to about 0.5%-1% loss per hour. However, both `broctl netstats` and `cat /proc/net/pf_ring/*eth0*` report some packet loss still. Is the sub-1% packet loss we’re seeing expected/optimal or are there additional tweaks that we could add to push this down to 0%? ### some notes > both `tcpdump -nn -s0 -vv -i eth0 -w /dev/null` and the pfcount.c utility from pf\_ring report 0% packet loss. It’s not until we start using bro that we start seeing dropped packets. > we’re currently using 16 bro processes pinned to 16 of 32 total processors > PF\_RING buffer size is currently 65536 > packet loss does seem to go down during low-traffic hours but during the day when traffic is 2.5-3 gbps is when the dropped packet count peaks (while still being a small percentage of the overall traffic) Let me know if you guys have any thoughts on this, thanks! * * * Nicholas Siow Washington University in St. Louis :: Information Security ---
**Author:** ![Joe\_Blow](https://avatars.discourse-cdn.com/v4/letter/j/dec6dc/32.png) [@Joe\_Blow](https://community.zeek.org/u/Joe_Blow)\ **Post date:** [August 29, 2014, 4:20pm UTC](https://community.zeek.org/t/dropped-packets-in-pf-ring-install/3248/2 "2014-08-29T16:20:05Z")
Can you paste your node.cfg here? I’m having similar problems, but my packet loss is much, much higher. Cheers, JB ---
**Author:** ![Mike\_Reeves](https://avatars.discourse-cdn.com/v4/letter/m/22d042/32.png) [@Mike\_Reeves](https://community.zeek.org/u/Mike_Reeves)\ **Post date:** [August 29, 2014, 4:22pm UTC](https://community.zeek.org/t/dropped-packets-in-pf-ring-install/3248/3 "2014-08-29T16:22:54Z")
Are the pins to actual CPUs or hyper threads? How much throughput are you dealing with? ---
**Author:** ![Nicholas\_SIow](https://avatars.discourse-cdn.com/v4/letter/n/46a35a/32.png) [@Nicholas\_SIow](https://community.zeek.org/u/Nicholas_SIow)\ **Post date:** [August 29, 2014, 4:23pm UTC](https://community.zeek.org/t/dropped-packets-in-pf-ring-install/3248/4 "2014-08-29T16:23:46Z")
Sure. It’s pretty standard and is more or less copied from the bro page on Load Balancing — ```auto [manager] type=manager host=localhost ``` ---
**Author:** ![Nicholas\_SIow](https://avatars.discourse-cdn.com/v4/letter/n/46a35a/32.png) [@Nicholas\_SIow](https://community.zeek.org/u/Nicholas_SIow)\ **Post date:** [August 29, 2014, 4:26pm UTC](https://community.zeek.org/t/dropped-packets-in-pf-ring-install/3248/5 "2014-08-29T16:26:44Z")
Actual CPUs, based on /proc/cpuinfo. During the day I’m usually seeing traffic in the realm of 2.75-3.25 gbps. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/dropped-packets-in-pf-ring-install/3248/6 "2022-05-06T15:42:01Z")