Zeek + PF_Ring Issue
Jorge García Rodríguez <[email protected]> Wed, 18 Dec 2019 10:29:33 +0000
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <AM0PR07MB421092D8B36179E7E3CDA783EB530@AM0PR07MB4210.eurprd07.prod.outlook.com> |
--===============1503794746==
Content-Language: es-ES
Content-Type: multipart/alternative;
boundary="_000_AM0PR07MB421092D8B36179E7E3CDA783EB530AM0PR07MB4210eurp_"
--_000_AM0PR07MB421092D8B36179E7E3CDA783EB530AM0PR07MB4210eurp_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Hi Zeekers!
I need to resolve a problem attached to Zeek when its configured to work wi=
th PF_Ring.
The thing is that we receive between 1.0 and 2.5 GB/s in a fiber interface.=
Also when we lauch the command "Zeekctl top" to check the Cpu usage and th=
e traffic managed in each worker, we see that the sum of the traffic of all=
workers is greater than the traffic we receive through the interface.
This makes me think that we have something badly configured in PF_Ring or s=
omehow Zeek is generating some kind of loop.
For example, receiving 2Gb/s, i execute "Zeekctl top" and the result is the=
next one:
Name Type Host Pid VSize Rss Cpu Cmd
logger logger localhost 11474 3G 118M 50% zeek
manager manager localhost 11520 589M 98M 25% zeek
proxy-1 proxy localhost 11565 610M 113M 18% zeek
worker-1-1 worker localhost 11693 1G 570M 62% zeek
worker-1-2 worker localhost 11701 1G 574M 62% zeek
worker-1-3 worker localhost 11711 1G 573M 68% zeek
worker-1-4 worker localhost 11713 1G 572M 50% zeek
worker-1-5 worker localhost 11718 3G 2G 106% zeek
worker-1-6 worker localhost 11719 1G 567M 62% zeek
worker-1-7 worker localhost 11726 1G 579M 68% zeek
worker-1-8 worker localhost 11732 1G 575M 56% zeek
worker-1-9 worker localhost 11733 1G 571M 68% zeek
worker-1-10 worker localhost 11735 1G 558M 62% zeek
Hope someone of you can help me to resolve this.
Really thank you.
Best Regards!
--_000_AM0PR07MB421092D8B36179E7E3CDA783EB530AM0PR07MB4210eurp_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-=
1">
<style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo=
ttom:0;} </style>
</head>
<body dir=3D"ltr">
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
Hi Zeekers!</div>
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
I need to resolve a problem attached to Zeek when its configured to work wi=
th PF_Ring.</div>
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
The thing is that we receive between 1.0 and 2.5 GB/s in a fiber interface.=
Also when we lauch the command "Zeekctl top" to check the Cpu us=
age and the traffic managed in each worker, we see that the sum of the traf=
fic of all workers is greater than the traffic
we receive through the interface.</div>
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
This makes me think that we have something badly configured in PF_Ring or s=
omehow Zeek is generating some kind of loop.<br>
</div>
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
For example, receiving 2Gb/s, i execute "Zeekctl top" and the res=
ult is the next one:</div>
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
<span>Name Type Host =
Pid VSize Rss Cpu &n=
bsp; Cmd<br>
</span>
<div>logger logger localhost  =
; 11474 3G 118M 50% zeek<br>
</div>
<div>manager manager localhost &nb=
sp;11520 589M 98M 25% zeek<br>
</div>
<div>proxy-1 proxy localhost  =
; 11565 610M 113M 18% zeek<br>
</div>
<div>worker-1-1 worker localhost 11=
693 1G 570M 62% zeek<br>
</div>
<div>worker-1-2 worker localhost 11=
701 1G 574M 62% zeek<br>
</div>
<div>worker-1-3 worker localhost 11=
711 1G 573M 68% zeek<br>
</div>
<div>worker-1-4 worker localhost 11=
713 1G 572M 50% zeek<br>
</div>
<div>worker-1-5 worker localhost 11=
718 3G 2G 106% zeek<br>
</div>
<div>worker-1-6 worker localhost 11=
719 1G 567M 62% zeek<br>
</div>
<div>worker-1-7 worker localhost 11=
726 1G 579M 68% zeek<br>
</div>
<div>worker-1-8 worker localhost 11=
732 1G 575M 56% zeek<br>
</div>
<div>worker-1-9 worker localhost 11=
733 1G 571M 68% zeek<br>
</div>
<div>worker-1-10 worker localhost 11=
735 1G 558M 62% zeek<br>
</div>
<span></span><br>
</div>
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
Hope someone of you can help me to resolve this.</div>
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
Really thank you.</div>
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
Best Regards!</div>
</body>
</html>
--_000_AM0PR07MB421092D8B36179E7E3CDA783EB530AM0PR07MB4210eurp_--
--===============1503794746==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
--===============1503794746==--