[Bro] Bro 2.0 packets dropped

[Machiel van Veen]

On Friday 10 February 2012 16:26:48 Seth Hall wrote:
> It looks like you are missing the setting that turns on the pf_ring
>  clustering support.  If you built against the pf_ring libpcap wrapper it
>  should have been put in there automatically (unless you installed over top
>  of a previous installation?).
> 
> Add this to your broctl.cfg and do "check", "install", "restart" in broctl.
> PFRingClusterId = 21
> 
>   .Seth

I've added the option, there is no difference. I did notice in the debug logs 
before that this option has been set by default. At startup i see the 
following for all workers, proxy and manager:

"PCAP_PF_RING_USE_CLUSTER_PER_FLOW=1 PCAP_PF_RING_CLUSTER_ID=21"

The bro binary does seem to use the correct lib:

$ ldd /opt/bro/bin/bro | grep pcap
libpcap.so.1 => /usr/local/lib/libpcap.so.1 (0x00007fae5cad2000)

I'll go ahead and do this again on monday, perhaps I did make a mistake during 
the build process.

Thanks, Machiel.