[Bro] AF_PACKET on Ubuntu 16.04

[Michał Purzyński]

Have you disabled hardware hash with ethtool? By default kernel will use the card hash which is asymmetric.

You can verify it with ethtool -k <card>

Look for rxhash - should be disabled.

https://github.com/pevma/SEPTun

Should show you how to prepare your system, you can ignore the core isolation and affinity for bro.

> On Feb 22, 2017, at 3:29 PM, Gary Faulkner <gfaulkner.nsm at gmail.com> wrote:
> 
> I'm trying AF_PACKET with Bro, but seem to be running a kernel and 
> driver combo that doesn't appear to properly support symmetric hashing. 
> I'm on Ubuntu 16.04 with kernel 4.4.0-59-generic. From what I can tell 
> the patches should have been added around kernel 4.4.0-39 or so, but 
> Justin's verification tool and Bro both seem to agree that it is broken 
> on my system. I've tried with the OS supplied IXGBE driver (4.2.1-k) as 
> well as compiling from scratch using a recent IXGBE directly from Intel 
> (5.0.4). Is there a known working kernel and driver combo for Ubuntu 
> 16.04, or are the necessary patches still not pushed into 16.04?
> 
> Thanks,
> 
> Gary
> 
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20170222/d1a1b78d/attachment.html