# PF\_RING for Bro

**URL:** <https://community.zeek.org/t/pf-ring-for-bro/1762>\
**Category:** Zeek\
**Created:** [December 13, 2010, 10:44pm UTC](https://community.zeek.org/t/pf-ring-for-bro/1762 "2010-12-13T22:44:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sunjeet\_Singh](https://avatars.discourse-cdn.com/v4/letter/s/ecb155/32.png) [@Sunjeet\_Singh](https://community.zeek.org/u/Sunjeet_Singh)\
**Post date:** [December 13, 2010, 10:44pm UTC](https://community.zeek.org/t/pf-ring-for-bro/1762/1 "2010-12-13T22:44:59Z")

</div>

Hi,

I am looking at increasing the performance of Bro by making use of PF\_RING and TNAPI, at the kernel and driver level in Linux. These existing tools from [http://www.ntop.org/news.php](http://www.ntop.org/news.php) allow multi-threaded applications to drastically increase performance by making use of functionality that exists in several network cards today.

While PF\_RING, TNAPI and other network-card functionality allow for phenomenal speed-up, they have to be tuned right or else they can lead to a negative effect on performance. So I'm trying to determine how to tune them to meet Bro's needs.

As Multi-threaded Bro is not ready yet, I am trying to think of a SIMPLE application that can best characterize the Bro workload. The design criteria that I have for this application so far is-

1. Send every packet belonging to a particular connection to the same core.  
2. Introduce a small wait on every packet to simulate Bro's processing of that packet? What will be a good value?

I'd be very interested to have everyone's opinion on this. I really am looking for a very simple algorithm that will be a right approximation.

Thank you,  
Sunjeet Singh

---

<div class="post-metadata">

**Author:** ![Sunjeet\_Singh](https://avatars.discourse-cdn.com/v4/letter/s/ecb155/32.png) [@Sunjeet\_Singh](https://community.zeek.org/u/Sunjeet_Singh)\
**Post date:** [December 13, 2010, 10:50pm UTC](https://community.zeek.org/t/pf-ring-for-bro/1762/2 "2010-12-13T22:50:11Z")

</div>

Alternatively, can I have the source code for multi-threaded Bro? : )

Sunjeet

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [December 17, 2010, 10:01am UTC](https://community.zeek.org/t/pf-ring-for-bro/1762/3 "2010-12-17T10:01:32Z")

</div>

(Note, I haven't caught up with the follow-up trehad yet).

> > 1. Send every packet belonging to a particular connection to the same  
> > core.  
> > 2. Introduce a small wait on every packet to simulate Bro's processing  
> > of that packet? What will be a good value?

There probably isn't a good value. 🙂

I think I'd start with two things:

(1) Just doing nothing in the threads, and

(2) Accessing all the packets' bytes in some form within the  
threads, perhaps by calculating a simple checksum.

That should give you a good baseline, including an approximation of  
memory effects in (2).

It will be interesting to see the differece between (1) and (2), and  
also between them and a pure software version (copy the packets from  
a master thread to child threads "manually", as the current  
prototype is doing).

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/pf-ring-for-bro/1762/4 "2022-05-06T15:39:21Z")

</div>

Closed on May 6, 2022, 3:39pm UTC