[Bro] PF_RING ZC Config

Dave Crawford bro at pingtrip.com
Fri Jun 24 05:28:59 PDT 2016


Would anyone happen to have documentation for configuring ZC and Bro? I have NTop's PF_RING and ixgbe driver packages installed, the proper license in /etc/pf_ring, and have compiled Bro with the NTop libraries but I'm seeing the kernel error below along with a ton of “split routing” messages in weird.conf, so I suspect the flows aren’t being load balanced correctly.
 
Jun 22 15:10:03 win-csignsm-01 kernel: [11060.244524] [PF_RING] Unable to activate two or more ZC sockets on the same interface eth6/link direction

The monitored NIC is an Intel X520-LR1.

Contents of /etc/pf_ring/zc/ixgbe/ixgbe.conf: 
RSS=10 allow_unsupported_sfp=0

Contents of /etc/pf_ring/hugepages.conf
node=1 hugepages=1024


And Bro is configured as:
[MID_INT]
type=worker
host=10.20.30.123
interface=zc:eth6
lb_method=pf_ring
lb_procs=10
pin_cpus=10,11,12,13,14,15,16,17,18,19

Thanks!
-Dave
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160624/8631c1fc/attachment.html 


More information about the Bro mailing list