Recently I have some problems with Bro and PF_RING in cluster.
On my server, when I have less than 32 worker threads(rings),
everything is okay, but when I use worker threads more than 32, pf_ring
start to receive repeating data packets. For example, rings less than 32, I
send 400000 packets to server and pf_ring info in /proc shows there is
400000 packets in rings, but when rings greater than 32, I can get 800000
packets when 33 rings and 1200000 packets when 34 rings and so on.
I guess if there is some rules that a pf_ring or a bro cluster can only
support less than 32 rings or worker threads on a server or some other
Any insight would be helpful.
If you would like to join the monthly meeting today you can do so at:
This is a monthly call with the community to discuss topics related to
growing and sustaining the Zeek Community.
This call is a public call and will be recorded and shared. Registration is
* Zeek LT Update (Johanna Amann) - 5 mins
* Zeek Technical Update (Robin Sommer) - 5 mins
* Zeek Sub-group Updates - 15 mins
* Questions/New Topics - 5 mins