[Bro] Bro Packet Loss / 10gb ixgbe / pf_ring

[Baxter Milliwew]

PF_RING ZC works, you have to set the ClusterID as the single interface in
node.cfg (zc:2).  What you are missing is the PF_RING ancillary application
zbalance_ipc to PCAP and fanout to virtual interfaces.  You need to read
the pf_ring docs for that as you'll also need hugepages support.

Also you do not need or want to use RSS with ZC so disable that by
configuring a single queue.

For example: Start zbalance_ipc PCAP from ZC interface eth4 with a
clusterID of 2 and 16 virtual interfaces, bind the app to the NIC attached
NUMA core #3, use IP hashing, set a queue size that won't exhaust local
NUMA memory.

example:  zbalance_ipc -i zc:eth4 -c 2 -n 16 -g 3 -m 1 -q 4096  then start
bro

As someone else mentioned the current pf_ring compatibility requires an
entire cluster restart when a worker crashes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160125/ea83066e/attachment.html