[Bro] Issue: load balancer PF_RING drops 25% of incoming packets

philosnef philosnef at yahoo.com
Wed Jul 27 06:51:34 PDT 2016

Did you compile both tcpdump and libpcap on the box inside of pfring source directory and confirm ldd shows that those libraries are actually called in bro? If you built the kernel module, tcpdump, and libpcap, but ldd shows that pf_ring's libpcap isnt compiled into bro, you will see issues. Big ones.
Also, did you run set_irq_affinity $interface?
The only reason I can see Bro dropping packets on a pcap file would be if bro isn't properly compiled against the correct libpcap. In theory, that shouldn't happen either. But for sure on a live link, you will see this kind of drop rate in that situation.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160727/9cbefa3a/attachment.html 

More information about the Bro mailing list