Re: Zeek + PF_Ring Issue
Phil Rzewski <[email protected]> Wed, 18 Dec 2019 07:13:24 -0800
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <[email protected]> |
--===============1571925292== Content-Type: multipart/alternative; boundary="Apple-Mail=_8F29E7FC-DE28-4466-99A6-8173988C9F7B" --Apple-Mail=_8F29E7FC-DE28-4466-99A6-8173988C9F7B Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Jorge, Have you checked for duplicate events in Zeek? I recall when I set up = Zeek with PF_RING, I followed the instructions at = https://www.zeek.org/documentation/load-balancing.html = <https://www.zeek.org/documentation/load-balancing.html> and only = followed the instructions through the "Using PF_RING" paragraph. In my = case I was pinning to four CPUs, and what I found was that I was getting = four copies of the all sniffed network traffic onto my Zeek environment, = one going to each worker. The symptom that tipped me off is that I would = see was four "conn" events for a given connection, each with all the = same source/dest/byte counts/etc. but each had a different UID. I = suspect that if I continued on to additional paragraphs I would have = been able to get past this problem (note how in the paragraph "Using = PF_RING+DNA with symmetric RSS" it says "You can sniff each packet only = once"... don't we always want that? :) ) Alas, I'm not 100% sure of the = solution as I started using a different Zeek approach instead. Hope it = helps though. -- Phil > On Dec 18, 2019, at 2:29 AM, Jorge Garc=C3=ADa Rodr=C3=ADguez = <[email protected]> wrote: >=20 > Hi Zeekers! >=20 > I need to resolve a problem attached to Zeek when its configured to = work with PF_Ring. >=20 > The thing is that we receive between 1.0 and 2.5 GB/s in a fiber = interface. Also when we lauch the command "Zeekctl top" to check the Cpu = usage and the traffic managed in each worker, we see that the sum of the = traffic of all workers is greater than the traffic we receive through = the interface. >=20 > This makes me think that we have something badly configured in PF_Ring = or somehow Zeek is generating some kind of loop. >=20 > For example, receiving 2Gb/s, i execute "Zeekctl top" and the result = is the next one: >=20 > Name Type Host Pid VSize Rss Cpu Cmd > logger logger localhost 11474 3G 118M 50% zeek > manager manager localhost 11520 589M 98M 25% zeek > proxy-1 proxy localhost 11565 610M 113M 18% zeek > worker-1-1 worker localhost 11693 1G 570M 62% zeek > worker-1-2 worker localhost 11701 1G 574M 62% zeek > worker-1-3 worker localhost 11711 1G 573M 68% zeek > worker-1-4 worker localhost 11713 1G 572M 50% zeek > worker-1-5 worker localhost 11718 3G 2G 106% zeek > worker-1-6 worker localhost 11719 1G 567M 62% zeek > worker-1-7 worker localhost 11726 1G 579M 68% zeek > worker-1-8 worker localhost 11732 1G 575M 56% zeek > worker-1-9 worker localhost 11733 1G 571M 68% zeek > worker-1-10 worker localhost 11735 1G 558M 62% zeek >=20 > Hope someone of you can help me to resolve this. >=20 > Really thank you. >=20 > Best Regards! > _______________________________________________ > Zeek mailing list > [email protected] <mailto:[email protected]> > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek = <http://mailman.icsi.berkeley.edu/mailman/listinfo/zeek> --Apple-Mail=_8F29E7FC-DE28-4466-99A6-8173988C9F7B Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; = charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;" = class=3D"">Jorge,<div class=3D""><br class=3D""></div><div class=3D"">Have= you checked for duplicate events in Zeek? I recall when I set up Zeek = with PF_RING, I followed the instructions at <a = href=3D"https://www.zeek.org/documentation/load-balancing.html" = class=3D"">https://www.zeek.org/documentation/load-balancing.html</a> = ;and only followed the instructions through the "Using PF_RING" = paragraph. In my case I was pinning to four CPUs, and what I found was = that I was getting four copies of the all sniffed network traffic onto = my Zeek environment, one going to each worker. The symptom that tipped = me off is that I would see was four "conn" events for a given = connection, each with all the same source/dest/byte counts/etc. but each = had a different UID. I suspect that if I continued on to additional = paragraphs I would have been able to get past this problem (note how in = the paragraph "Using PF_RING+DNA with symmetric RSS" it says = "<span class=3D"" style=3D"color: rgb(51, 51, 51); font-family: Arial, = Helvetica, sans-serif; font-size: 15px; font-variant-ligatures: normal; = orphans: 2; text-align: justify; widows: 2; background-color: rgb(255, = 255, 255);">You can sniff each packet only once"... don't we always = want that? :) ) Alas, I'm not 100% sure of the solution as I started = using a different Zeek approach instead. Hope it helps = though.</span></div><div class=3D""><div class=3D"" style=3D"orphans: 2; = text-align: justify; widows: 2;"><font color=3D"#333333" face=3D"Arial, = Helvetica, sans-serif" class=3D""><span class=3D"" style=3D"font-size: = 15px; background-color: rgb(255, 255, 255);"><br = class=3D""></span></font></div><div class=3D"" style=3D"orphans: 2; = text-align: justify; widows: 2;"><font color=3D"#333333" face=3D"Arial, = Helvetica, sans-serif" class=3D""><span class=3D"" style=3D"font-size: = 15px; background-color: rgb(255, 255, 255);">--</span></font></div><div = class=3D"" style=3D"orphans: 2; text-align: justify; widows: 2;"><font = color=3D"#333333" face=3D"Arial, Helvetica, sans-serif" class=3D""><span = class=3D"" style=3D"font-size: 15px; background-color: rgb(255, 255, = 255);">Phil</span></font></div><div class=3D"" style=3D"orphans: 2; = text-align: justify; widows: 2;"><font color=3D"#333333" face=3D"Arial, = Helvetica, sans-serif" class=3D""><span class=3D"" style=3D"font-size: = 15px; background-color: rgb(255, 255, 255);"><br = class=3D""></span></font></div></div><div><br class=3D""><blockquote = type=3D"cite" class=3D""><div class=3D"">On Dec 18, 2019, at 2:29 AM, = Jorge Garc=C3=ADa Rodr=C3=ADguez <<a = href=3D"mailto:[email protected]" = class=3D"">[email protected]</a>> wrote:</div><br = class=3D"Apple-interchange-newline"><div class=3D""><div = style=3D"font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;" class=3D"">Hi = Zeekers!</div><div style=3D"font-style: normal; font-variant-caps: = normal; font-weight: normal; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none; font-family: Calibri, Arial, Helvetica, sans-serif; font-size: = 12pt;" class=3D""><br class=3D""></div><div style=3D"font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none; font-family: Calibri, Arial, Helvetica, = sans-serif; font-size: 12pt;" class=3D"">I need to resolve a problem = attached to Zeek when its configured to work with PF_Ring.</div><div = style=3D"font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;" class=3D""><br = class=3D""></div><div style=3D"font-style: normal; font-variant-caps: = normal; font-weight: normal; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none; font-family: Calibri, Arial, Helvetica, sans-serif; font-size: = 12pt;" class=3D"">The thing is that we receive between 1.0 and 2.5 GB/s = in a fiber interface. Also when we lauch the command "Zeekctl top" to = check the Cpu usage and the traffic managed in each worker, we see that = the sum of the traffic of all workers is greater than the traffic we = receive through the interface.</div><div style=3D"font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none; font-family: Calibri, Arial, Helvetica, = sans-serif; font-size: 12pt;" class=3D""><br class=3D""></div><div = style=3D"font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;" class=3D"">This = makes me think that we have something badly configured in PF_Ring or = somehow Zeek is generating some kind of loop.<br class=3D""></div><div = style=3D"font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;" class=3D""><br = class=3D""></div><div style=3D"font-style: normal; font-variant-caps: = normal; font-weight: normal; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none; font-family: Calibri, Arial, Helvetica, sans-serif; font-size: = 12pt;" class=3D"">For example, receiving 2Gb/s, i execute "Zeekctl top" = and the result is the next one:</div><div style=3D"font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none; font-family: Calibri, Arial, Helvetica, = sans-serif; font-size: 12pt;" class=3D""><br class=3D""></div><div = style=3D"font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;" class=3D""><span = class=3D"">Name Type Host = Pid VSize = Rss Cpu Cmd<br class=3D""></span><div class=3D"">logger= logger localhost = 11474 3G 118M 50% zeek<br = class=3D""></div><div class=3D"">manager manager = localhost 11520 589M 98M = 25% zeek<br class=3D""></div><div class=3D"">proxy-1 = proxy localhost 11565 = 610M 113M 18% zeek<br class=3D""></div><div = class=3D"">worker-1-1 worker localhost = 11693 1G 570M 62% zeek<br = class=3D""></div><div class=3D"">worker-1-2 worker = localhost 11701 1G = 574M 62% zeek<br class=3D""></div><div class=3D"">worker-1-3 = worker localhost 11711 = 1G 573M 68% zeek<br class=3D""></div><div = class=3D"">worker-1-4 worker localhost = 11713 1G 572M 50% zeek<br = class=3D""></div><div class=3D"">worker-1-5 worker = localhost 11718 3G = 2G 106% zeek<br class=3D""></div><div class=3D"">worker-1-6 = worker localhost 11719 = 1G 567M 62% zeek<br class=3D""></div><div = class=3D"">worker-1-7 worker localhost = 11726 1G 579M 68% zeek<br = class=3D""></div><div class=3D"">worker-1-8 worker = localhost 11732 1G = 575M 56% zeek<br class=3D""></div><div class=3D"">worker-1-9 = worker localhost 11733 = 1G 571M 68% zeek<br class=3D""></div><div = class=3D"">worker-1-10 worker localhost = 11735 1G 558M 62% zeek<br = class=3D""></div><span class=3D""></span><br class=3D""></div><div = style=3D"font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;" class=3D"">Hope = someone of you can help me to resolve this.</div><div style=3D"font-style:= normal; font-variant-caps: normal; font-weight: normal; letter-spacing: = normal; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none; font-family: Calibri, Arial, Helvetica, = sans-serif; font-size: 12pt;" class=3D""><br class=3D""></div><div = style=3D"font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;" class=3D"">Really= thank you.</div><div style=3D"font-style: normal; font-variant-caps: = normal; font-weight: normal; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none; font-family: Calibri, Arial, Helvetica, sans-serif; font-size: = 12pt;" class=3D""><br class=3D""></div><div style=3D"font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none; font-family: Calibri, Arial, Helvetica, = sans-serif; font-size: 12pt;" class=3D"">Best Regards!</div><span = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 14px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; float: none; = display: inline !important;" = class=3D"">_______________________________________________</span><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 14px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;" class=3D""><span = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 14px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; float: none; = display: inline !important;" class=3D"">Zeek mailing list</span><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 14px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;" class=3D""><a = href=3D"mailto:[email protected]" style=3D"font-family: Helvetica; = font-size: 14px; font-style: normal; font-variant-caps: normal; = font-weight: normal; letter-spacing: normal; orphans: auto; text-align: = start; text-indent: 0px; text-transform: none; white-space: normal; = widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; = -webkit-text-stroke-width: 0px;" class=3D"">[email protected]</a><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 14px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;" class=3D""><a = href=3D"http://mailman.icsi.berkeley.edu/mailman/listinfo/zeek" = style=3D"font-family: Helvetica; font-size: 14px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = orphans: auto; text-align: start; text-indent: 0px; text-transform: = none; white-space: normal; widows: auto; word-spacing: 0px; = -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" = class=3D"">http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek</a></div= ></blockquote></div><br class=3D""></body></html>= --Apple-Mail=_8F29E7FC-DE28-4466-99A6-8173988C9F7B-- --===============1571925292== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek --===============1571925292==--