[Bro] Fwd: Configure error linking libpcap and pthread

James Lay jlay at slave-tothe-box.net
Fri Aug 29 08:21:03 PDT 2014


On 2014-08-29 08:58, Doug Burks wrote:
> It's possible that Bro is not actually using PF_RING and is actually
> falling back to standard libpcap.  Have you checked 
> /proc/net/pf_ring/
> to see if there is evidence of Bro using PF_RING?
>
> On Fri, Aug 29, 2014 at 10:53 AM, Joe Blow <blackhole.em at gmail.com> 
> wrote:
>> So i've gone and recompiled with PF_RING 6.  I have everything 
>> working and
>> using PF_RING correctly, but i'm still seeing packet loss (around 
>> 25% on a
>> 400-450mb/s link).   I was only ever able to get Bro working with
>> "Transparent mode = 0" and not 2 or 1.  I might be doing something
>> completely wrong, but whenever i start BRO, i only ever see one 
>> thread
>> peaking at 100%. Here is my node configuration:
>>
>> [worker-0]
>> type=worker
>> host=10.10.10.10
>> interface=eth3
>> lb_method=pf_ring
>> lb_procs=12
>>
>> Any ideas as to why i'm only getting one thread seeing the bro 
>> traffic?
>> Excuse my ignorance.
>>
>> Cheers,
>>
>> JB

ldd your bro bin as well:

[09:20:17 ubuntu-test:/usr/local/bro/bin$] ldd bro
         linux-gate.so.1 =>  (0xb778b000)
         libpcap.so.1 => /opt/pfring/lib/libpcap.so.1 (0xb7730000)

James



More information about the Bro mailing list