[Bro] Use PFRING_ZC for Bro

[Clement Chen]

I was seeing 60% packet loss rate. After some aggressive BPF filtering, it
went down to about 15%-20%.

Are you using a big box? Mine is 24 core CPU with 64GB mem. There is an
email thread about Bro with 10G card and many people also see pretty
significant packet loss.

It would be great if you can share your configs and also your traffic
throughput.

Thanks.

-Clement

On Tue, Jan 27, 2015 at 1:35 PM, Greg Williams <gwillia5 at uccs.edu> wrote:

> Why do you want to use it?  I’m using security onion with Bro and 2x2
> Intel x520 10Gb cards and have no packet loss with the base SO
> configuration.
>
>
>
> Greg Williams, M.E., ISA, GPEN, GCFE
>
> Director of Networks and Infrastructure
> Interim IT Security Manager/Information Security Officer/HIPAA Security
> Officer
> University of Colorado Colorado Springs - Department of Information
> Technology
> Phone: 719-255-3211
>
>
>
> *From:* bro-bounces at bro.org [mailto:bro-bounces at bro.org] *On Behalf Of *Clement
> Chen
> *Sent:* Tuesday, January 27, 2015 2:22 PM
> *To:* bro at bro.org
> *Subject:* [Bro] Use PFRING_ZC for Bro
>
>
>
> Hi all,
>
>
>
> I am trying to use PFRING_ZC for Bro in my security onion box. I got the
> license from ntop but there was little document on how to enable this.
>
>
>
> Would appreciate any help/pointer to docs. I will compile a step-by-step
> instructions if I get this working.
>
>
>
> I have the Intel 82599EB 10G card and the ixgbe-zc driver installed.
>
>
>
> #dkms status
>
> ixgbe-zc, 3.22.3, 3.13.0-44-generic, x86_64: installed
>
> pf_ring, 6, 3.13.0-35-generic, x86_64: installed
>
> pf_ring, 6, 3.13.0-44-generic, x86_64: installed (WARNING! Diff between
> built and installed module!)
>
> pfring, 6.0.3, 3.13.0-44-generic, x86_64: installed
>
>
>
> not sure what to do next and how to enable it for Bro.
>
>
>
> Thanks.
>
>
>
> -Clement
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20150127/f3218eb9/attachment.html