[Bro] Bro with PF_RING receive repeating data packets
cardigliano at ntop.org
Thu Sep 1 10:55:39 PDT 2016
there is a limit to the number of sockets in a pf_ring kernel cluster,
it used to be 32, now I increased it to 64 which I guess should be enough.
> On 01 Sep 2016, at 17:23, Seth Hall <seth at icir.org> wrote:
>> On Sep 1, 2016, at 4:44 AM, Bowen Li <newfire.bw at gmail.com> wrote:
>> On my server, when I have less than 32 worker threads(rings), everything is okay, but when I use worker threads more than 32, pf_ring start to receive repeating data packets. For example, rings less than 32, I send 400000 packets to server and pf_ring info in /proc shows there is 400000 packets in rings, but when rings greater than 32, I can get 800000 packets when 33 rings and 1200000 packets when 34 rings and so on.
> That sounds like an issue with PF_Ring. I would check their documentation and mailing list to see if they only support 32 rings.
> Seth Hall
> International Computer Science Institute
> (Bro) because everyone has a network
> Bro mailing list
> bro at bro-ids.org
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 842 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160901/0f2ddfa6/attachment-0001.bin
More information about the Bro