[Bro] Bro with PF_RING receive repeating data packets

Seth Hall seth at icir.org
Thu Sep 1 08:23:04 PDT 2016


> On Sep 1, 2016, at 4:44 AM, Bowen Li <newfire.bw at gmail.com> wrote:
> 
>     On my server, when I have less than 32 worker threads(rings), everything is okay, but when I use worker threads more than 32, pf_ring start to receive repeating data packets. For example, rings less than 32, I send 400000 packets to server and pf_ring info in /proc shows there is 400000 packets in rings, but when rings greater than 32, I can get 800000 packets when 33 rings and 1200000 packets when 34 rings and so on.

That sounds like an issue with PF_Ring.  I would check their documentation and mailing list to see if they only support 32 rings.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/




More information about the Bro mailing list