[Bro] AF_PACKET on Ubuntu 16.04

Gary Faulkner gfaulkner.nsm at gmail.com
Wed Feb 22 15:29:40 PST 2017

I'm trying AF_PACKET with Bro, but seem to be running a kernel and 
driver combo that doesn't appear to properly support symmetric hashing. 
I'm on Ubuntu 16.04 with kernel 4.4.0-59-generic. From what I can tell 
the patches should have been added around kernel 4.4.0-39 or so, but 
Justin's verification tool and Bro both seem to agree that it is broken 
on my system. I've tried with the OS supplied IXGBE driver (4.2.1-k) as 
well as compiling from scratch using a recent IXGBE directly from Intel 
(5.0.4). Is there a known working kernel and driver combo for Ubuntu 
16.04, or are the necessary patches still not pushed into 16.04?



More information about the Bro mailing list