[Bro] bro and pf_ring zc configuration success stories

[Azoff, Justin S]

> On Sep 28, 2017, at 12:55 PM, radek <radoslawc at gmail.com> wrote:
> 
> > Can you configure your traffic generator to send it "real" traffic?
> 
> that's the setup, it is even called Real-World Traffic (TM) by vendor. currently that's the only way for me to have somewhat reproducible test results in my setup.


Can you set the rate to 200mbit then for a bit?  You need to get things to a point where the workers are running properly without drops.

Then once the configuration looks correct and bro is logging proper connections you can start ramping the rate back up.

Based on the "error: 99.17%, 7562 out of 7625 connections are half duplex" from before, nothing was working properly... and 50% drops alone wouldn't cause that.

— 
Justin Azoff