[67471.840125] CR2: 00007f0d8459607f
---
### Author:  [@JustinAzoff](https://community.zeek.org/u/JustinAzoff)
#### Post date: [May 15, 2019, 9:35pm UTC](https://community.zeek.org/t/zeek-myricom-port-aggregation/5699/2 "2019-05-15T21:35:56Z")
That looks like a bug in the myricom Driver and not zeek. Can you
reproduce the same kernel issue using tcpdump? You configure
aggregation for that using SNF\_FLAGS:
SNF\_FLAGS=0x2 (Port aggregation (or merging))
Flag 0x2 says that the port number that is passed to an application is actually
a mask of port, not just one port.
For example, when using tcpdump:
export SNF\_FLAGS=0x2
env SNF\_FLAGS=0x2 /path/to/tcpdump -i snf3
Without SNF\_FLAGS=0x2, you would actually try to open snf port 3 (which
may not exist if you only have one adapter.)
It's possible that you don't need to use aggregation in the first
place, That is generally only needed if you are connecting a fiber
tap directly into a card. If flows are being load balanced across
multiple ports you can just run two different sets of workers, one for
each port
---
### Author:  [@greg](https://community.zeek.org/u/greg)
#### Post date: [May 15, 2019, 10:04pm UTC](https://community.zeek.org/t/zeek-myricom-port-aggregation/5699/3 "2019-05-15T22:04:40Z")
tcpdump works perfectly with aggregation, no issues
---
### Author:  [@greg](https://community.zeek.org/u/greg)
#### Post date: [June 5, 2019, 6:32pm UTC](https://community.zeek.org/t/zeek-myricom-port-aggregation/5699/4 "2019-06-05T18:32:18Z")
Just an update:
I contacted Myricom support about this issue a while back and haven't
heard anything in a while from them so I believe they are unable to
duplicate it perhaps, as they generally fix kernel problems very quickly
in my experience.
Fortunately I will be swapping drives in an array and will need to take
Zeek down, so I will experiment for a bit before bringing it back up and
see if I can figure out what the issue is.
This kind of experimentation is very difficult when you don't have a dev
system to test on. 😛
Greg
---
### Author:  [@JustinAzoff](https://community.zeek.org/u/JustinAzoff)
#### Post date: [June 5, 2019, 6:39pm UTC](https://community.zeek.org/t/zeek-myricom-port-aggregation/5699/5 "2019-06-05T18:39:43Z")
Oh, I forgot to send you the recommended configuration for 2 cards in one box…
Most likely you don’t need to be merging the ports… as long as the arista or something is merging the flows for you each port is already getting a consistent subset of flows. At that point the on card aggregation doesn’t do anything for you.
I would use a configuration like this:
[node-foo-card1]
interface = p1p1
lb\_method=myricom
lb\_procs=9
#check hwloc for numa/pci info
pin\_cpus=1,3,5,7,9,…
[node-foo-card2]
interface = p2p1
lb\_method=myricom
lb\_procs=9
#check hwloc for numa/pci info
pin\_cpus=2,4,6,8,…
the hardest part is using the right pin\_cpus settings. It’s a little easier if you disable HT and then check to see which card is attached to which cpu using hwloc. sometimes it doesn’t matter much, but on some motherboards you can make sure you match up pci slots to physical cpus to avoid moving data between the numa nodes.
---
### Author:  [@greg](https://community.zeek.org/u/greg)
#### Post date: [June 5, 2019, 10:22pm UTC](https://community.zeek.org/t/zeek-myricom-port-aggregation/5699/6 "2019-06-05T22:22:13Z")
Thanks for that Justin, however I am merging two ports on a single card
and the reason for doing so is the Arista has 2 x 10G taps and
aggregating those links within the switch causes drops on the switch due
to periodic microbursts that exceed the bandwidth to a single 10G tool
port. The other option of aggregating the traffic in the switch to the
40G ports as a tool port isn't a viable solution.
This is really vexing because tcpdump has 0 trouble reading the
aggregated ports, so while the kernel panic error information points to
the SNF software as a cause; I wonder...
Greg
---
### Author:  [@greg](https://community.zeek.org/u/greg)
#### Post date: [June 5, 2019, 10:30pm UTC](https://community.zeek.org/t/zeek-myricom-port-aggregation/5699/7 "2019-06-05T22:30:35Z")
Other problem is I am running timemachine on this box, I think it would
be a little dicey trying to run two separate instances of Zeek and TM -
not even sure running two instances of TM would work...
---
### Author:  [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/zeek-myricom-port-aggregation/5699/8 "2022-05-06T15:46:30Z")