[Bro] Fwd: Configure error linking libpcap and pthread
James Lay
jlay at slave-tothe-box.net
Fri Aug 29 08:21:03 PDT 2014
On 2014-08-29 08:58, Doug Burks wrote:
> It's possible that Bro is not actually using PF_RING and is actually
> falling back to standard libpcap. Have you checked
> /proc/net/pf_ring/
> to see if there is evidence of Bro using PF_RING?
>
> On Fri, Aug 29, 2014 at 10:53 AM, Joe Blow <blackhole.em at gmail.com>
> wrote:
>> So i've gone and recompiled with PF_RING 6. I have everything
>> working and
>> using PF_RING correctly, but i'm still seeing packet loss (around
>> 25% on a
>> 400-450mb/s link). I was only ever able to get Bro working with
>> "Transparent mode = 0" and not 2 or 1. I might be doing something
>> completely wrong, but whenever i start BRO, i only ever see one
>> thread
>> peaking at 100%. Here is my node configuration:
>>
>> [worker-0]
>> type=worker
>> host=10.10.10.10
>> interface=eth3
>> lb_method=pf_ring
>> lb_procs=12
>>
>> Any ideas as to why i'm only getting one thread seeing the bro
>> traffic?
>> Excuse my ignorance.
>>
>> Cheers,
>>
>> JB
ldd your bro bin as well:
[09:20:17 ubuntu-test:/usr/local/bro/bin$] ldd bro
linux-gate.so.1 => (0xb778b000)
libpcap.so.1 => /opt/pfring/lib/libpcap.so.1 (0xb7730000)
James
More information about the Bro
mailing list