[Bro] Bro with PF_RING receive repeating data packets

[Alfredo Cardigliano]

Hi all
there is a limit to the number of sockets in a pf_ring kernel cluster,
it used to be 32, now I increased it to 64 which I guess should be enough.

Alfredo

> On 01 Sep 2016, at 17:23, Seth Hall <seth at icir.org> wrote:
> 
> 
>> On Sep 1, 2016, at 4:44 AM, Bowen Li <newfire.bw at gmail.com> wrote:
>> 
>>    On my server, when I have less than 32 worker threads(rings), everything is okay, but when I use worker threads more than 32, pf_ring start to receive repeating data packets. For example, rings less than 32, I send 400000 packets to server and pf_ring info in /proc shows there is 400000 packets in rings, but when rings greater than 32, I can get 800000 packets when 33 rings and 1200000 packets when 34 rings and so on.
> 
> That sounds like an issue with PF_Ring.  I would check their documentation and mailing list to see if they only support 32 rings.
> 
>  .Seth
> 
> --
> Seth Hall
> International Computer Science Institute
> (Bro) because everyone has a network
> http://www.bro.org/
> 
> 
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 842 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160901/0f2ddfa6/attachment-0001.bin