[Bro] PF_RING ZC Config

[Dave Crawford]

Just wanted to update the list that I quit spending cycles on this and for the time being reverted back to running our clusters with the non-commercial version of pf_ring.

I can only comment on my experience, but I discovered there is an extreme lack of quality documentation and the "commercial support" that came with the 10 licenses was nearly non-existent.

Lessons have been learned and when the need to expand comes we'll be looking at other commercial solutions to replace our X520's with.

-Dave
  
> On Jun 24, 2016, at 8:28 AM, Dave Crawford <bro at pingtrip.com> wrote:
> 
> Would anyone happen to have documentation for configuring ZC and Bro? I have NTop's PF_RING and ixgbe driver packages installed, the proper license in /etc/pf_ring, and have compiled Bro with the NTop libraries but I'm seeing the kernel error below along with a ton of “split routing” messages in weird.conf, so I suspect the flows aren’t being load balanced correctly.
>  
> Jun 22 15:10:03 win-csignsm-01 kernel: [11060.244524] [PF_RING] Unable to activate two or more ZC sockets on the same interface eth6/link direction
> 
> The monitored NIC is an Intel X520-LR1.
> 
> Contents of /etc/pf_ring/zc/ixgbe/ixgbe.conf: 
> RSS=10 allow_unsupported_sfp=0
> 
> Contents of /etc/pf_ring/hugepages.conf
> node=1 hugepages=1024
> 
> 
> And Bro is configured as:
> [MID_INT]
> type=worker
> host=10.20.30.123
> interface=zc:eth6
> lb_method=pf_ring
> lb_procs=10
> pin_cpus=10,11,12,13,14,15,16,17,18,19
> 
> Thanks!
> -Dave
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160707/4f063c7e/attachment.html