[Bro] Bro with PF_RING receive repeating data packets
newfire.bw at gmail.com
Thu Sep 1 18:43:55 PDT 2016
Thanks for your reply.
I found a definition in kernel/linux/pf_ring.h in PF_RING source code.
The "CLUSTER_LEN" define the maximum of sockets a cluster can holds.
Now I`m sure it is a issue with PF_RING. And I also
increased "CLUSTER_LEN" to 64 and it seems like everything is okay. But I`m
still confuse about why the limit set to 32 and whether it is right to
modify the source code. Will it affect the stability of PF_RING and Bro?
2016-09-02 1:55 GMT+08:00 Alfredo Cardigliano <cardigliano at ntop.org>:
> Hi all
> there is a limit to the number of sockets in a pf_ring kernel cluster,
> it used to be 32, now I increased it to 64 which I guess should be enough.
> > On 01 Sep 2016, at 17:23, Seth Hall <seth at icir.org> wrote:
> >> On Sep 1, 2016, at 4:44 AM, Bowen Li <newfire.bw at gmail.com> wrote:
> >> On my server, when I have less than 32 worker threads(rings),
> everything is okay, but when I use worker threads more than 32, pf_ring
> start to receive repeating data packets. For example, rings less than 32, I
> send 400000 packets to server and pf_ring info in /proc shows there is
> 400000 packets in rings, but when rings greater than 32, I can get 800000
> packets when 33 rings and 1200000 packets when 34 rings and so on.
> > That sounds like an issue with PF_Ring. I would check their
> documentation and mailing list to see if they only support 32 rings.
> > .Seth
> > --
> > Seth Hall
> > International Computer Science Institute
> > (Bro) because everyone has a network
> > http://www.bro.org/
> > _______________________________________________
> > Bro mailing list
> > bro at bro-ids.org
> > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Bro