[Bro] bro and pf_ring zc configuration success stories

[Azoff, Justin S]

> On Sep 26, 2017, at 6:07 PM, radek <radoslawc at gmail.com> wrote:
> 
> Hi!
> 
> Anyone care to share bro + pfring success story?
> 
> What's the speed, what NIC, what's the configuration.
> 
> I'm running bro 2.5.1 built with jemalloc and gperftools and against pf_ring 6.6.0 with ixgbe_zc on CentOS 7.2.

You can't be using both jemalloc and gperftools(tcmalloc).. they are both malloc implementations.

> In ZeroCopy mode with zbalance_ipc dividing NIC to 20 application rings (-n 20) I'm getting each CPU core loaded at 100% and around 50% packet drop (reported by netstats in broctl).

Sounds like the load balancing is not working right and you are just analyzing all of your traffic 20 times.  What does your node.cfg contain?

> When redirecting from zc to 20 dummy interfaces (zbalance_ipc -r 0:dummy0 and so on) I'm getting around 50% load on each core and a lot less of packet drop (10% - 15%). 
> 
> This is with traffic around 700 - 800 Mbit/s  

A few workers should be able to handle this load, not to mention 20..

> All input will be highly appreciated.
> 

Can you install bro-pkg (http://bro-package-manager.readthedocs.io/en/stable/quickstart.html) and then do

bro-pkg install bro-doctor --version 1.16.1
broctl doctor.bro

And share the results.

— 
Justin Azoff