[Bro] Packet Drops

[Justin Azoff]

On Thu, May 03, 2012 at 09:10:40PM -0400, Tom OBrion wrote:
> Need some thoughts from the LINUX/BRO gifted....
> 
> Hardware:
> 
> CPU: two - Intel(R) Xeon(TM) CPU 2.40GHz
> MEM: 2gig
> NIC's: Intel(R) PRO/1000 Network Driver - version 7.3.21-k8-NAPI
> 
> We  peak around 130mbps and at this time we are running around 10mbps.
>  No matter what speed we run at we continue to drop packets.  We have
> loaded pf_ring and load balanced across two NIC's based on Martin's
> BLOG:  http://ossectools.blogspot.com/2011/09/bro-quickstart-cluster-edition.html

Can you post the contents of the files in /proc/net/pf_ring/ for the bro
processes?  You should have one per bro worker.


-- 
-- Justin Azoff
-- Network Security & Performance Analyst