Re: Zeek + PF_Ring Issue
Justin Azoff <[email protected]> Wed, 18 Dec 2019 16:29:37 -0500
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CAPfnCuixhw1-mBGYNT77xqf2Fx+JWTgPJ0zB2HEgm3K+4KVB=Q@mail.gmail.com> |
--===============1379932090== Content-Type: multipart/alternative; boundary="000000000000620fac059a012621" --000000000000620fac059a012621 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Can you run bro-doctor: https://packages.bro.org/packages/view/1251f948-f435-11e9-9321-0a645a3f3086 (works with zeek, just didn't change the name). that will likely tell you what is wrong. You're probably not actually using pf_ring and should use the native plugin and not the pcap wrapper. On Wed, Dec 18, 2019 at 5:31 AM Jorge Garc=C3=ADa Rodr=C3=ADguez < [email protected]> wrote: > Hi Zeekers! > > I need to resolve a problem attached to Zeek when its configured to work > with PF_Ring. > > The thing is that we receive between 1.0 and 2.5 GB/s in a fiber > interface. Also when we lauch the command "Zeekctl top" to check the Cpu > usage and the traffic managed in each worker, we see that the sum of the > traffic of all workers is greater than the traffic we receive through the > interface. > > This makes me think that we have something badly configured in PF_Ring or > somehow Zeek is generating some kind of loop. > > For example, receiving 2Gb/s, i execute "Zeekctl top" and the result is > the next one: > > Name Type Host Pid VSize Rss Cpu Cmd > logger logger localhost 11474 3G 118M 50% zeek > manager manager localhost 11520 589M 98M 25% zeek > proxy-1 proxy localhost 11565 610M 113M 18% zeek > worker-1-1 worker localhost 11693 1G 570M 62% zeek > worker-1-2 worker localhost 11701 1G 574M 62% zeek > worker-1-3 worker localhost 11711 1G 573M 68% zeek > worker-1-4 worker localhost 11713 1G 572M 50% zeek > worker-1-5 worker localhost 11718 3G 2G 106% zeek > worker-1-6 worker localhost 11719 1G 567M 62% zeek > worker-1-7 worker localhost 11726 1G 579M 68% zeek > worker-1-8 worker localhost 11732 1G 575M 56% zeek > worker-1-9 worker localhost 11733 1G 571M 68% zeek > worker-1-10 worker localhost 11735 1G 558M 62% zeek > > Hope someone of you can help me to resolve this. > > Really thank you. > > Best Regards! > _______________________________________________ > Zeek mailing list > [email protected] > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek --=20 Justin --000000000000620fac059a012621 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Can you run bro-doctor:=C2=A0<a href=3D"https://packages.b= ro.org/packages/view/1251f948-f435-11e9-9321-0a645a3f3086">https://packages= .bro.org/packages/view/1251f948-f435-11e9-9321-0a645a3f3086</a>=C2=A0(works= with zeek, just didn't change the name).=C2=A0 that will likely tell y= ou what is wrong.=C2=A0 You're probably not actually using pf_ring and = should use the native plugin and not the pcap wrapper.</div><br><div class= =3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Wed, Dec 18, 2019= at 5:31 AM Jorge Garc=C3=ADa Rodr=C3=ADguez <<a href=3D"mailto:JorgeGar= [email protected]">[email protected]</a>> wrote:<br></div><b= lockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-le= ft:1px solid rgb(204,204,204);padding-left:1ex"> <div dir=3D"ltr"> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> Hi Zeekers!</div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> I need to resolve a problem attached to Zeek when its configured to work wi= th PF_Ring.</div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> The thing is that we receive between 1.0 and 2.5 GB/s in a fiber interface.= Also when we lauch the command "Zeekctl top" to check the Cpu us= age and the traffic managed in each worker, we see that the sum of the traf= fic of all workers is greater than the traffic we receive through the interface.</div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> This makes me think that we have something badly configured in PF_Ring or s= omehow Zeek is generating some kind of loop.<br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> For example, receiving 2Gb/s, i execute "Zeekctl top" and the res= ult is the next one:</div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> <span>Name =C2=A0 =C2=A0 =C2=A0 =C2=A0 Type =C2=A0 =C2=A0Host =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 Pid =C2=A0 =C2=A0 VSize =C2=A0Rss =C2=A0Cpu = =C2=A0 Cmd<br> </span> <div>logger =C2=A0 =C2=A0 =C2=A0 logger =C2=A0localhost =C2=A0 =C2=A0 =C2= =A0 =C2=A011474 =C2=A0 =C2=A0 3G =C2=A0 118M =C2=A050% =C2=A0zeek<br> </div> <div>manager =C2=A0 =C2=A0 =C2=A0manager localhost =C2=A0 =C2=A0 =C2=A0 =C2= =A011520 =C2=A0 589M =C2=A0 =C2=A098M =C2=A025% =C2=A0zeek<br> </div> <div>proxy-1 =C2=A0 =C2=A0 =C2=A0proxy =C2=A0 localhost =C2=A0 =C2=A0 =C2= =A0 =C2=A011565 =C2=A0 610M =C2=A0 113M =C2=A018% =C2=A0zeek<br> </div> <div>worker-1-1 =C2=A0 worker =C2=A0localhost =C2=A0 =C2=A0 =C2=A0 =C2=A011= 693 =C2=A0 =C2=A0 1G =C2=A0 570M =C2=A062% =C2=A0zeek<br> </div> <div>worker-1-2 =C2=A0 worker =C2=A0localhost =C2=A0 =C2=A0 =C2=A0 =C2=A011= 701 =C2=A0 =C2=A0 1G =C2=A0 574M =C2=A062% =C2=A0zeek<br> </div> <div>worker-1-3 =C2=A0 worker =C2=A0localhost =C2=A0 =C2=A0 =C2=A0 =C2=A011= 711 =C2=A0 =C2=A0 1G =C2=A0 573M =C2=A068% =C2=A0zeek<br> </div> <div>worker-1-4 =C2=A0 worker =C2=A0localhost =C2=A0 =C2=A0 =C2=A0 =C2=A011= 713 =C2=A0 =C2=A0 1G =C2=A0 572M =C2=A050% =C2=A0zeek<br> </div> <div>worker-1-5 =C2=A0 worker =C2=A0localhost =C2=A0 =C2=A0 =C2=A0 =C2=A011= 718 =C2=A0 =C2=A0 3G =C2=A0 =C2=A0 2G 106% =C2=A0zeek<br> </div> <div>worker-1-6 =C2=A0 worker =C2=A0localhost =C2=A0 =C2=A0 =C2=A0 =C2=A011= 719 =C2=A0 =C2=A0 1G =C2=A0 567M =C2=A062% =C2=A0zeek<br> </div> <div>worker-1-7 =C2=A0 worker =C2=A0localhost =C2=A0 =C2=A0 =C2=A0 =C2=A011= 726 =C2=A0 =C2=A0 1G =C2=A0 579M =C2=A068% =C2=A0zeek<br> </div> <div>worker-1-8 =C2=A0 worker =C2=A0localhost =C2=A0 =C2=A0 =C2=A0 =C2=A011= 732 =C2=A0 =C2=A0 1G =C2=A0 575M =C2=A056% =C2=A0zeek<br> </div> <div>worker-1-9 =C2=A0 worker =C2=A0localhost =C2=A0 =C2=A0 =C2=A0 =C2=A011= 733 =C2=A0 =C2=A0 1G =C2=A0 571M =C2=A068% =C2=A0zeek<br> </div> <div>worker-1-10 =C2=A0worker =C2=A0localhost =C2=A0 =C2=A0 =C2=A0 =C2=A011= 735 =C2=A0 =C2=A0 1G =C2=A0 558M =C2=A062% =C2=A0zeek<br> </div> <span></span><br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> Hope someone of you can help me to resolve this.</div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> Really thank you.</div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt= ;color:rgb(0,0,0)"> Best Regards!</div> </div> _______________________________________________<br> Zeek mailing list<br> <a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a><br> <a href=3D"http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek" rel=3D"n= oreferrer" target=3D"_blank">http://mailman.ICSI.Berkeley.EDU/mailman/listi= nfo/zeek</a></blockquote></div><br clear=3D"all"><div><br></div>-- <br><div= dir=3D"ltr" class=3D"gmail_signature"><div dir=3D"ltr">Justin</div></div> --000000000000620fac059a012621-- --===============1379932090== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek --===============1379932090==--