[Bro] Bro with PF_RING receive repeating data packets

[Bowen Li]

Hi all,
    Thanks for your reply.
    I found a definition in kernel/linux/pf_ring.h in PF_RING source code.
The "CLUSTER_LEN" define the maximum of sockets a cluster can holds.
    Now I`m sure it is a issue with PF_RING. And I also
increased "CLUSTER_LEN" to 64 and it seems like everything is okay. But I`m
still confuse about why the limit set to 32 and whether it is right to
modify the source code. Will it affect the stability of PF_RING and Bro?

Bowen

2016-09-02 1:55 GMT+08:00 Alfredo Cardigliano <cardigliano at ntop.org>:

> Hi all
> there is a limit to the number of sockets in a pf_ring kernel cluster,
> it used to be 32, now I increased it to 64 which I guess should be enough.
>
> Alfredo
>
> > On 01 Sep 2016, at 17:23, Seth Hall <seth at icir.org> wrote:
> >
> >
> >> On Sep 1, 2016, at 4:44 AM, Bowen Li <newfire.bw at gmail.com> wrote:
> >>
> >>    On my server, when I have less than 32 worker threads(rings),
> everything is okay, but when I use worker threads more than 32, pf_ring
> start to receive repeating data packets. For example, rings less than 32, I
> send 400000 packets to server and pf_ring info in /proc shows there is
> 400000 packets in rings, but when rings greater than 32, I can get 800000
> packets when 33 rings and 1200000 packets when 34 rings and so on.
> >
> > That sounds like an issue with PF_Ring.  I would check their
> documentation and mailing list to see if they only support 32 rings.
> >
> >  .Seth
> >
> > --
> > Seth Hall
> > International Computer Science Institute
> > (Bro) because everyone has a network
> > http://www.bro.org/
> >
> >
> > _______________________________________________
> > Bro mailing list
> > bro at bro-ids.org
> > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160902/a410c550/attachment.html