Version Info:
Zeek 3.2.0-dev.53
pfring-7.5.0-2838.x86_64
We currently utilize zbalance_ipc to load balance our traffic on our zeek boxes. I built a new box the other day, and now zeek refuses to work with any interface that zbalance_ipc creates. This works fine on all of our existing boxes which are currently running Zeek 3.1.0-dev.292.
Example:
zbalance_ipc -i zc:eth1 -n 1 -m 1 -c 10 -g 1 -a (creates zc:10@0)
[root@server opt]# zeek -i zc:10@0
listening on zc:10@0
error: Failed to register fd 22 from PktSrc: Bad address
fatal error: Failed to register pktsrc fd with iosource_mgr
Has anyone ran into this issue?
Thanks,
Tim
That looks like an issue with the new IOSource changes in 3.1. Is the code for that plugin public and something I could go look at? We tested it pretty heavily with the pcap, af_packet, and myricom plugins so it might be something with that plugin specifically.
Tim
ah, you’re using pf_ring through the libpcap wrapper and their wrapper is doing something weird. This problem should go away using https://github.com/ntop/bro-pf_ring (and likely better performance too since you won’t need the wrapper)
That package may need a few updates to the cmake bits to compile properly against zeek… as well as the configure changes that make it possible to build plugins without the zeek source code.
Yah, that would definitely explain it. Libpcap is probably setting the file descriptor to something weird after trying to open ’zc:10’ and that’s causing Zeek to throw an error. I’ll see if we can make that a little more friendly.
I recently fixed the af_packet plugin to build correctly with Zeek 3.1 and the process is pretty simple. If you want to look at those changes as a roadmap, go for it. We should have a blog post coming out pretty soon on zeek.org about it. Otherwise I’ll add it to my list for next week.
Tim