[Bro] PF_RING ZC Config
bro at pingtrip.com
Thu Jul 7 15:25:54 PDT 2016
Just wanted to update the list that I quit spending cycles on this and for the time being reverted back to running our clusters with the non-commercial version of pf_ring.
I can only comment on my experience, but I discovered there is an extreme lack of quality documentation and the "commercial support" that came with the 10 licenses was nearly non-existent.
Lessons have been learned and when the need to expand comes we'll be looking at other commercial solutions to replace our X520's with.
> On Jun 24, 2016, at 8:28 AM, Dave Crawford <bro at pingtrip.com> wrote:
> Would anyone happen to have documentation for configuring ZC and Bro? I have NTop's PF_RING and ixgbe driver packages installed, the proper license in /etc/pf_ring, and have compiled Bro with the NTop libraries but I'm seeing the kernel error below along with a ton of “split routing” messages in weird.conf, so I suspect the flows aren’t being load balanced correctly.
> Jun 22 15:10:03 win-csignsm-01 kernel: [11060.244524] [PF_RING] Unable to activate two or more ZC sockets on the same interface eth6/link direction
> The monitored NIC is an Intel X520-LR1.
> Contents of /etc/pf_ring/zc/ixgbe/ixgbe.conf:
> RSS=10 allow_unsupported_sfp=0
> Contents of /etc/pf_ring/hugepages.conf
> node=1 hugepages=1024
> And Bro is configured as:
> Bro mailing list
> bro at bro-ids.org
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Bro