[Bro] Re : Fwd: Big Packet loss and PacketFilter::Dropped_Packets

[Vikram Basu]

I tried doing that but it did not seem to be all that helpful for me. What kind of network bandwidth are you handling and also how many CPU cores and amount of RAM have you given to Bro I wonder ?

Regards,

Vikram Basu
Seceon Inc.



Hello there Vikram!

We are running the same Bro 2.5.2 with pf_ring and we also had the pinned CPUs and had a lot of packet drops.
After a couple tests, we managed to get the packet drops to 0 by unpinning the CPU procs, letting the OS do the dirty job.
We have being running like that for a couple days now, without drops.

Hope you can get it working!

Regards,

Felipe Tavares
OpenCloud Factory

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20171204/0c733ad4/attachment.html