# PF\_Ring and Bro - packet loss **URL:** \ **Category:** Zeek\ **Created:** [September 11, 2015, 6:38pm UTC](https://community.zeek.org/t/pf-ring-and-bro-packet-loss/3821 "2015-09-11T18:38:42Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![nathanael\_rayborn](https://avatars.discourse-cdn.com/v4/letter/n/47e85d/32.png) [@nathanael\_rayborn](https://community.zeek.org/u/nathanael_rayborn)\ **Post date:** [September 11, 2015, 6:38pm UTC](https://community.zeek.org/t/pf-ring-and-bro-packet-loss/3821/1 "2015-09-11T18:38:42Z")
I’m experiencing high packet loss (15% -50%) with Bro 2.4 compiled with PF\_Ring. PFcount (pfcount -i eth0 -e 1) shows 0% packet loss while /proc/net/pf\_ring/PID shows the same number of dropped packets as broctl netstats. The github link contains all changes and performance steps I’ve taken so far along with output from PFcount, broctl, and ethtool. Has anyone else experienced similar performance issues or have recommendations to get my dropped packets as close to 0% as possible? Thanks Current config - [https://gist.github.com/nate-ray/8b4d03eab49d11715398](https://gist.github.com/nate-ray/8b4d03eab49d11715398) ---
**Author:** ![Jason\_Williams](https://avatars.discourse-cdn.com/v4/letter/j/5fc32e/32.png) [@Jason\_Williams](https://community.zeek.org/u/Jason_Williams)\ **Post date:** [September 11, 2015, 7:07pm UTC](https://community.zeek.org/t/pf-ring-and-bro-packet-loss/3821/2 "2015-09-11T19:07:24Z")
Nathanael, Just from initial glance you may want to allocate more slots in pfring… Min Num Slots : 4096 Bucket Len : 8192 Slot Len : 8224 [bucket+header] Tot Memory : 33697792 Tot Packets : 153298629 Tot Pkt Lost : 60413245 Tot Insert : 92885384 Tot Read : 92829402 Insert Offset : 3522336 Remove Offset : 3537608 Num Free Slots : 0 \<-------------- maybe modprobe pf\_ring enable\_tx\_capture=0 min\_num\_slots=32768 ---
**Author:** ![Adam\_Pumphrey1](https://avatars.discourse-cdn.com/v4/letter/a/9d8465/32.png) [@Adam\_Pumphrey1](https://community.zeek.org/u/Adam_Pumphrey1)\ **Post date:** [September 11, 2015, 7:55pm UTC](https://community.zeek.org/t/pf-ring-and-bro-packet-loss/3821/3 "2015-09-11T19:55:56Z")
Your broctl status output shows Bro is in standalone mode and not configured to take advantage of pf\_ring. You’ll need to configure a local cluster with the pf\_ring specific options set for the monitoring interface/worker. [https://www.bro.org/sphinx-git/configuration/index.html#using-pf-ring](https://www.bro.org/sphinx-git/configuration/index.html#using-pf-ring) Something like this might work in your case; notice the lb\_method and lb\_procs settings for the worker: [manager] type=manager host=127.0.0.1 [proxy-1] type=proxy host=127.0.0.1 [worker-1] type=worker host=127.0.0.1 interface=eth0 lb\_method=pf\_ring lb\_procs=2 I think you need at least 2 lb\_procs for pf\_ring to provide any performance gain. You can also set cpu affinity for the worker processes; this is recommended for better performance and cluster stability, but not required. If you do be sure to specify only physical cpu/core ID’s. I believe the general rule of thumb is to leave half of your physical cores freed up for the OS and other Bro processes. For example: pin\_cpus=2,3 # assumes a single quad-core with core ID’s 0-3 There are a few more pf\_ring specific options available in BroControl’s config file. You can check them out here [https://www.bro.org/sphinx/components/broctl/README.html#pfringclusterid](https://www.bro.org/sphinx/components/broctl/README.html#pfringclusterid) You might want to give “broctl capstats” and the capture-loss Bro script a try also; both are really helpful with troubleshooting traffic capture issues. -Adam ---
**Author:** ![Vito\_Logrillo](https://avatars.discourse-cdn.com/v4/letter/v/e9bcb4/32.png) [@Vito\_Logrillo](https://community.zeek.org/u/Vito_Logrillo)\ **Post date:** [September 15, 2015, 8:44am UTC](https://community.zeek.org/t/pf-ring-and-bro-packet-loss/3821/4 "2015-09-15T08:44:04Z")
Which is the maximum slot number that can be handled by Bro? Thanks ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/pf-ring-and-bro-packet-loss/3821/5 "2022-05-06T15:43:04Z")