How to confige the "cluster type" using PF_RING doing loadbalance

Zeek
1

any configuration can be set to specify the tuple-type of PF_RING(without ZC).
I am running zeek 5.0.2.

configurations likes follows:
[worker-1]
type=worker
host=localhost
interface=enp3s0
lb_method=pf_ring
lb_procs=6
pin_cpus=3,5,7,11,13,15

and which tuple-type zeek used ?

2

and which tuple-type zeek used ?

The default is 4-tuple as documented in the zeekctl doc:

PFRINGClusterType (string, default “4-tuple”)
If PF_RING flow-based load balancing is desired, this is where the PF_RING cluster type is defined. Allowed values are: 2-tuple, 4-tuple, 5-tuple, tcp-5-tuple, 6-tuple, or round-robin. Zeek must be linked with PF_RING’s libpcap wrapper and PFRINGClusterID must be non-zero for this option to work.

In your configuration section for worker-1, you can set any of the above mentioned values.

There’s a PR that adds a few more load balancing methods (specifically “inner” ones) in case that’s interesting to you.

4

Thanks.

I changed the configuration to follows:
[worker-1]
type=worker
host=localhost
interface=enp3s0
lb_method=pf_ring
lb_procs=6
pin_cpus=3,5,7,11,13,15
env_vars=PCAP_PF_RING_CLUSTER_ID=99

[worker-2]
type=worker
host=localhost
interface=enp3s0
lb_method=pf_ring
lb_procs=6
pin_cpus=2,4,6,10,12,14
env_vars=PCAP_PF_RING_CLUSTER_ID=99

I don’t specify the tuple-type in configuration, I checked the sourcecode in libpcap, the default type is PCAP_PF_RING_USE_CLUSTER_PER_FLOW_5_TUPLE

5

I don’t specify the tuple-type in configuration, I checked the sourcecode in libpcap, the default type is PCAP_PF_RING_USE_CLUSTER_PER_FLOW_5_TUPLE

Hmm, please double check the environment of one of your workers (cat /proc/<pid>/environ | tr '\0' '\n') for pfring related environment variables.

Because you’re using zeekctl, it should be defaulting to 4-tuple and setting PCAP_PF_RING_USE_CLUSTER_PER_FLOW_4_TUPLE which may not be what you want.

Consider setting PFRINGClusterType if that’s not what you want.

You can also replace env_vars=PCAP_PF_RING_CLUSTER_ID=99 with setting PFRINGClusterID.

6

Thanks for your detail comments.
Now I am clear about this feature.
Thanks