[Bro] Issue: load balancer PF_RING drops 25% of incoming packets

[Rosinger, Enno (DualStudy)]

Hey All,

I am running Bro with configured PF_RING load balancing.

Strangely only 16 Million of my 21 Million packet input pass through the PF_RING kernel module. Nevertheless they are then distributed correctly on the Bro processes.
How can I avoid this loss of 5 Million packets and how can I verify that PF_RING is configured correctly?

I use Intel Corporation I350 Gigabit Network Connection as NICs. They work with the igb drivers.
The input rate is 0.5Gb/s = 60k to 80k packets/s and currently I am working without the ZeroCopy drivers
It is verified that all of my 21 Million packets are received by my NIC's driver.
The PF_Ring module itself exists and BRO is running with load balancing.

Looking forward to your response and hope to solve this problem with you. Below you will find more detailed information about my system.
If you need something else let me know.

Best,
Enno

Additional information:

One interesting fact: I cannot run "make" in "PF_RING/userland/examples", because
gcc: error: ../libpcap/libpcap.a: No such file or directory

PF_RING/userland looks like this. Indeed "libpcap" is missing
c++  examples  examples_zc  fast_bpf  go  lib  libpcap-1.7.4  Makefile  snort  tcpdump-4.7.4

PF_RING module
[root at slinky-3-4 ~]# cat /proc/net/pf_ring/info
PF_RING Version          : 6.5.0 (dev:9e221bc0b91040afee98f3e3c22ce83226f63f3e)
Total rings              : 0

Standard (non ZC) Options
Ring slots               : 32768
Slot version             : 16
Capture TX               : No [RX only]
IP Defragment            : No
Socket Mode              : Standard
Total plugins            : 0
Cluster Fragment Queue   : 0
Cluster Fragment Discard : 0

Used NICs
[rosinger at slinky-3-4 ~]$ lspci | egrep -i --color 'network|ethernet'
02:00.0 Ethernet controller: Intel Corporation I350 Gigabit Network Connection (rev 01)
02:00.1 Ethernet controller: Intel Corporation I350 Gigabit Network Connection (rev 01)

NICs Drivers
[rosinger @slinky-3-4 ~]# ethtool -i eno2
driver: igb
version: 5.2.15-k
firmware-version: 1.61, 0x80000cd5, 1.1067.0
bus-info: 0000:02:00.1
supports-statistics: yes
supports-test: yes
supports-eeprom-access: yes
supports-register-dump: yes
supports-priv-flags: no


Enno Rosinger
Student DualStudy Business Informatics - Application Management

+49 617 22685124 Office
Hewlett-Packard-Straße 1| 61352 Bad Homburg | Germany
enno.rosinger at hpe.com<mailto:enno.rosinger at hpe.com>

[HPE_logoemail]

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160726/143899b1/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 5715 bytes
Desc: image001.png
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160726/143899b1/attachment.bin