Uhmm ... I have changed my config to:
But it doesn't work. Error is:
fatal error: problem with interface af_packet::eth2 (Invalid argument)
C. L. Martinez
On 29/01/2019, 11:31, "zeek-bounces(a)zeek.org on behalf of Jan Grashöfer"
<zeek-bounces(a)zeek.org on behalf of jan.grashoefer(a)gmail.com> wrote:
On 29/01/2019 08:33, Carlos Lopez wrote:
Thanks Michal. Error is "Invalid argument"
... But what is "af_packet_fanout_id"? is it a random value?
From the man page (http://man7.org/linux/man-pages/man7/packet.7.html
To scale processing across threads, packet sockets can
fanout group. In this mode, each matching packet is enqueued
onto only one socket in the group. A socket joins a fanout
group by calling setsockopt(2) with level SOL_PACKET and
option PACKET_FANOUT. Each network namespace can have up to
65536 independent groups. A socket selects a group by encod‐
ing the ID in the first 16 bits of the integer option value.
The first packet socket to join a group implicitly creates it.
To successfully join an existing group, subsequent packet
sockets must have the same protocol, device settings, fanout
mode and flags (see below). Packet sockets can leave a fanout
group only by closing the socket. The group is deleted when
the last socket is closed.
So as Michal suggested, you want to configure different fanout IDs for
the both workers to support different NICs.
Zeek mailing list