[Bro] PF_RING ZC Config

Alfredo Cardigliano cardigliano at ntop.org
Fri Jul 8 00:51:48 PDT 2016

Hi Dave
how did you ask support? I do not see any related issue in our ticketing system nor in email threads.


> On 08 Jul 2016, at 00:25, Dave Crawford <bro at pingtrip.com> wrote:
> Just wanted to update the list that I quit spending cycles on this and for the time being reverted back to running our clusters with the non-commercial version of pf_ring.
> I can only comment on my experience, but I discovered there is an extreme lack of quality documentation and the "commercial support" that came with the 10 licenses was nearly non-existent.
> Lessons have been learned and when the need to expand comes we'll be looking at other commercial solutions to replace our X520's with.
> -Dave
>> On Jun 24, 2016, at 8:28 AM, Dave Crawford <bro at pingtrip.com <mailto:bro at pingtrip.com>> wrote:
>> Would anyone happen to have documentation for configuring ZC and Bro? I have NTop's PF_RING and ixgbe driver packages installed, the proper license in /etc/pf_ring, and have compiled Bro with the NTop libraries but I'm seeing the kernel error below along with a ton of “split routing” messages in weird.conf, so I suspect the flows aren’t being load balanced correctly.
>> Jun 22 15:10:03 win-csignsm-01 kernel: [11060.244524] [PF_RING] Unable to activate two or more ZC sockets on the same interface eth6/link direction
>> The monitored NIC is an Intel X520-LR1.
>> Contents of /etc/pf_ring/zc/ixgbe/ixgbe.conf:
>> RSS=10 allow_unsupported_sfp=0
>> Contents of /etc/pf_ring/hugepages.conf
>> node=1 hugepages=1024
>> And Bro is configured as:
>> [MID_INT]
>> type=worker
>> host=
>> interface=zc:eth6
>> lb_method=pf_ring
>> lb_procs=10
>> pin_cpus=10,11,12,13,14,15,16,17,18,19
>> Thanks!
>> -Dave
>> _______________________________________________
>> Bro mailing list
>> bro at bro-ids.org <mailto:bro at bro-ids.org>
>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160708/c54dc796/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 842 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160708/c54dc796/attachment.bin 

More information about the Bro mailing list