[Bro] AF_PACKET on Ubuntu 16.04
michalpurzynski1 at gmail.com
Wed Feb 22 15:51:47 PST 2017
Have you disabled hardware hash with ethtool? By default kernel will use the card hash which is asymmetric.
You can verify it with ethtool -k <card>
Look for rxhash - should be disabled.
Should show you how to prepare your system, you can ignore the core isolation and affinity for bro.
> On Feb 22, 2017, at 3:29 PM, Gary Faulkner <gfaulkner.nsm at gmail.com> wrote:
> I'm trying AF_PACKET with Bro, but seem to be running a kernel and
> driver combo that doesn't appear to properly support symmetric hashing.
> I'm on Ubuntu 16.04 with kernel 4.4.0-59-generic. From what I can tell
> the patches should have been added around kernel 4.4.0-39 or so, but
> Justin's verification tool and Bro both seem to agree that it is broken
> on my system. I've tried with the OS supplied IXGBE driver (4.2.1-k) as
> well as compiling from scratch using a recent IXGBE directly from Intel
> (5.0.4). Is there a known working kernel and driver combo for Ubuntu
> 16.04, or are the necessary patches still not pushed into 16.04?
> Bro mailing list
> bro at bro-ids.org
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Bro