[Bro] High drop rates on recent builds

[Donaldson, John]

Robin,

It looks like this problem existed prior to or on 22 September, which was when I most recently rebuilt, and, looking back, started seeing the odd rates. I know that I rebuilt on the 9th, as well, because of the (since-resolved) issues with 3caecad265438b and specifying DAG streams. I'm stepping through commits now.

John Donaldson


> -----Original Message-----
> From: Robin Sommer [mailto:robin at icir.org]
> Sent: Wednesday, October 01, 2014 12:58 PM
> To: Donaldson, John
> Cc: bro at bro.org
> Subject: Re: [Bro] High drop rates on recent builds
> 
> Any idea at what time this started?
> 
> Two candidates I can think of:
> 
> commit e9692958f05fb17bc946a04a78313cc5dd0922de
> Date:   Thu Sep 25 12:46:39 2014 -0700
> 
>     Merge remote-tracking branch 'origin/topic/jsiwek/improve_comm_loop'
> 
> Merge: 3caecad 265438b
> Date:   Tue Sep 9 12:35:38 2014 -0500
> 
>     Merge remote-tracking branch 'origin/topic/robin/pktsrc'
> 
> If you're up for some experiments, you could switch to versions just before
> these merges and see if that helps.
> 
> Robin
> 
> On Wed, Oct 01, 2014 at 18:56 +0000, Donaldson, John wrote:
> 
> > On recent builds from the master branch, I'm seeing anomalously high drop
> rates.
> >
> > >From notice.log
> > 458745 packets dropped after filtering, 747736 received, 288991 on
> > link
> > 262140 packets dropped after filtering, 581026 received, 318886 on
> > link
> > 524280 packets dropped after filtering, 826789 received, 302509 on
> > link
> >
> > If I flip some of these values around to make sense (so that
> > dropped+received=onlink), I'm still left with really bad capture
> > rates. I'm running on DAG cards, and I can confirm that they, too,
> > think that I'm madly dropping packets on the floor, even though CPU
> > utilization for the Bro processes is hovering around 3%.
> >
> > By reverting back to the 2.3.1 tag, these problems go away.
> >
> > Any thoughts? Is anyone else seeing this?
> >
> > v/r
> >
> > John Donaldson
> >
> >
> >
> > _______________________________________________
> > Bro mailing list
> > bro at bro-ids.org
> > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
> >
> 
> 
> --
> Robin Sommer * Phone +1 (510) 722-6541 *     robin at icir.org
> ICSI/LBNL    * Fax   +1 (510) 666-2956 * www.icir.org/robin