Thanks for your reply.
I found a definition in kernel/linux/pf_ring.h in PF_RING source code.
The "CLUSTER_LEN" define the maximum of sockets a cluster can holds.
Now I`m sure it is a issue with PF_RING. And I also
increased "CLUSTER_LEN" to 64 and it seems like everything is okay. But I`m
still confuse about why the limit set to 32 and whether it is right to
modify the source code. Will it affect the stability of PF_RING and Bro?
2016-09-02 1:55 GMT+08:00 Alfredo Cardigliano <cardigliano(a)ntop.org>rg>:
there is a limit to the number of sockets in a pf_ring kernel cluster,
it used to be 32, now I increased it to 64 which I guess should be enough.
On 01 Sep 2016, at 17:23, Seth Hall
> On Sep 1, 2016, at 4:44 AM, Bowen Li <newfire.bw(a)gmail.com> wrote:
> On my server, when I have less than 32 worker threads(rings),
okay, but when I use worker threads more than 32, pf_ring
start to receive repeating data packets. For example, rings less than 32, I
send 400000 packets to server and pf_ring info in /proc shows there is
400000 packets in rings, but when rings greater than 32, I can get 800000
packets when 33 rings and 1200000 packets when 34 rings and so on.
That sounds like an issue with PF_Ring. I would check their
mailing list to see if they only support 32 rings.
International Computer Science Institute
(Bro) because everyone has a network
Bro mailing list