Hi Zeekers! I need to resolve a problem attached to Zeek when its configured to work with PF_Ring. The thing is that we receive between 1.0 and 2.5 GB/s in a fiber interface. Also when we lauch the command “Zeekctl top” to check the Cpu usage and the traffic managed in each worker, we see that the…

Jorge, Have you checked for duplicate events in Zeek? I recall when I set up Zeek with PF_RING, I followed the instructions at https://www.zeek.org/documentation/load-balancing.html and only followed the instructions through the “Using PF_RING” paragraph. In my case I was pinning to four CPUs, and …

I'm not certain if it's the exact root cause, but does the advice on PCAP_PF_RING_CLUSTER_ID at https://www.ntop.org/guides/pf_ring/thirdparty/bro.html apply? ...Bro needs to setup a pf_ring kernel cluster in order to split the traffic across the processes (otherwise your get duplicated data). …

Can you run bro-doctor: https://packages.bro.org/packages/view/1251f948-f435-11e9-9321-0a645a3f3086 (works with zeek, just didn’t change the name). that will likely tell you what is wrong. You’re probably not actually using pf_ring and should use the native plugin and not the pcap wrapper.

I have ran bro-doctor as you said and certainly I saw interesting things, for example:

I have ran bro-doctor as you said and certainly I saw interesting things, for example: ################################################################### Checking if connections are unevenly distributed across workers ################################################################### error: Th…

Enviado desde Outlook< http://aka.ms/weboutlook >

Zeek + PF_Ring Issue

Zeek

Topic		Replies	Views
Bad load balancing with PF_RING cluster Zeek	2	395	July 8, 2022
zeek worker nodes Zeek	2	152	May 6, 2022
Performance Issues after upgrade to Zeek-6 Zeek	8	529	August 2, 2023
Distributed deployment high cpu low network traffic Zeek	3	113	May 6, 2022
Packet loss and compilation issues with PF_RING plugin on Zeek 8.0.6 (3.5 Gbps traffic) Zeek	3	68	February 10, 2026

Zeek + PF_Ring Issue

Related topics