Re: Zeek + PF_Ring Issue
Jorge García Rodríguez <[email protected]> Thu, 19 Dec 2019 12:16:24 +0000
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <AM0PR07MB42101F9158BF38B89FC2AE17EB520@AM0PR07MB4210.eurprd07.prod.outlook.com> |
--===============0614072600== Content-Language: es-ES Content-Type: multipart/alternative; boundary="_000_AM0PR07MB42101F9158BF38B89FC2AE17EB520AM0PR07MB4210eurp_" --_000_AM0PR07MB42101F9158BF38B89FC2AE17EB520AM0PR07MB4210eurp_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable I have ran bro-doctor as you said and certainly I saw interesting things, f= or example: ################################################################### # Checking if connections are unevenly distributed across workers # ################################################################### error: The distribution of connections across workers seems uneven: worker-1-5: 462 connections worker-1-4: 890 connections worker-1-7: 874 connections worker-1-6: 4122 connections worker-1-1: 432 connections worker-1-3: 930 connections worker-1-2: 907 connections worker-1-9: 451 connections worker-1-8: 435 connections worker-1-10: 497 connections ###########################################################################= #################################################### # Checking if anything is in the deprecated local-logger.bro, local-manager= .bro, local-proxy.bro, or local-worker.bro scripts # ###########################################################################= #################################################### Nothing found ###################################################################### # Checking if any recent connections have been logged multiple times # ###################################################################### ok, only 0.00%, 0 out of 2429 connections appear to be duplicate ################################## # Checking pf_ring configuration # ################################## configured to use pf_ring=3DTrue pcap=3DTrue plugin=3DFalse ###########################################################################= #################################################### Let me know what do you think about the report. I have checked about the PF_Ring plugin but it gives me an error, im not su= re if im following the last update of this plugin. https://github.com/ntop/bro-pf_ring Also doing a further investigation it seems that the script that is overcha= rguing the cpu is the weird.zeek =BFIs there a way to disable this script? Thank you all for your replies. ________________________________ De: Justin Azoff <[email protected]> Enviado: mi=E9rcoles, 18 de diciembre de 2019 22:29 Para: Jorge Garc=EDa Rodr=EDguez <[email protected]> Cc: [email protected] <[email protected]> Asunto: Re: [Zeek] Zeek + PF_Ring Issue Can you run bro-doctor: https://packages.bro.org/packages/view/1251f948-f43= 5-11e9-9321-0a645a3f3086 (works with zeek, just didn't change the name). t= hat will likely tell you what is wrong. You're probably not actually using= pf_ring and should use the native plugin and not the pcap wrapper. On Wed, Dec 18, 2019 at 5:31 AM Jorge Garc=EDa Rodr=EDguez <JorgeGarcia.199= [email protected]<mailto:[email protected]>> wrote: Hi Zeekers! I need to resolve a problem attached to Zeek when its configured to work wi= th PF_Ring. The thing is that we receive between 1.0 and 2.5 GB/s in a fiber interface.= Also when we lauch the command "Zeekctl top" to check the Cpu usage and th= e traffic managed in each worker, we see that the sum of the traffic of all= workers is greater than the traffic we receive through the interface. This makes me think that we have something badly configured in PF_Ring or s= omehow Zeek is generating some kind of loop. For example, receiving 2Gb/s, i execute "Zeekctl top" and the result is the= next one: Name Type Host Pid VSize Rss Cpu Cmd logger logger localhost 11474 3G 118M 50% zeek manager manager localhost 11520 589M 98M 25% zeek proxy-1 proxy localhost 11565 610M 113M 18% zeek worker-1-1 worker localhost 11693 1G 570M 62% zeek worker-1-2 worker localhost 11701 1G 574M 62% zeek worker-1-3 worker localhost 11711 1G 573M 68% zeek worker-1-4 worker localhost 11713 1G 572M 50% zeek worker-1-5 worker localhost 11718 3G 2G 106% zeek worker-1-6 worker localhost 11719 1G 567M 62% zeek worker-1-7 worker localhost 11726 1G 579M 68% zeek worker-1-8 worker localhost 11732 1G 575M 56% zeek worker-1-9 worker localhost 11733 1G 571M 68% zeek worker-1-10 worker localhost 11735 1G 558M 62% zeek Hope someone of you can help me to resolve this. Really thank you. Best Regards! _______________________________________________ Zeek mailing list [email protected]<mailto:[email protected]> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek -- Justin --_000_AM0PR07MB42101F9158BF38B89FC2AE17EB520AM0PR07MB4210eurp_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-= 1"> <style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo= ttom:0;} </style> </head> <body dir=3D"ltr"> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> I have ran bro-doctor as you said and certainly I saw interesting things, f= or example:</div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> <br> </div> <div id=3D"Signature"> <div> <div id=3D"appendonsend"></div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> <span>###################################################################<b= r> </span> <div># Checking if connections are unevenly distributed across workers #<br= > </div> <div>###################################################################<br= > </div> <div>error: The distribution of connections across workers seems uneven:<br= > </div> <div>worker-1-5: 462 connections<br> </div> <div>worker-1-4: 890 connections<br> </div> <div>worker-1-7: 874 connections<br> </div> <div><span style=3D"background-color:rgb(255,0,0)">worker-1-6:  = ; 4122 connections</span><br> </div> <div>worker-1-1: 432 connections<br> </div> <div>worker-1-3: 930 connections<br> </div> <div>worker-1-2: 907 connections<br> </div> <div>worker-1-9: 451 connections<br> </div> <div>worker-1-8: 435 connections<br> </div> <div>worker-1-10: 497 connections<br> </div> <div><br> </div> <div><br> </div> <div>######################################################################= #########################################################<br> </div> <div># Checking if anything is in the deprecated local-logger.bro, local-ma= nager.bro, local-proxy.bro, or local-worker.bro scripts #<br> </div> <div>######################################################################= #########################################################<br> </div> <div>Nothing found<br> </div> <div><br> </div> <div><br> </div> <div>######################################################################= <br> </div> <div># Checking if any recent connections have been logged multiple times #= <br> </div> <div>######################################################################= <br> </div> <div><span style=3D"background-color:rgb(255,0,0)">ok, only 0.00%, 0 out of= 2429 connections appear to be duplicate</span><br> </div> <div><br> </div> <div><br> </div> <div><span>##################################<br> </span> <div># Checking pf_ring configuration #<br> </div> <div>##################################<br> </div> <div>configured to use pf_ring=3DTrue pcap=3DTrue plugin=3DFalse</div> <div><span style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; bac= kground-color: rgb(255, 255, 255); display: inline !important">############= ###########################################################################= ########################################</span><br> </div> <div><span style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; bac= kground-color: rgb(255, 255, 255); display: inline !important"><br> </span></div> <div><span style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; bac= kground-color: rgb(255, 255, 255); display: inline !important">Let me know = what do you think about the report.</span></div> <div><br> </div> <div>I have checked about the PF_Ring plugin but it gives me an error, im n= ot sure if im following the last update of this plugin.</div> <div><a href=3D"https://github.com/ntop/bro-pf_ring" id=3D"LPlnk597229">htt= ps://github.com/ntop/bro-pf_ring</a></div> <span></span><br> </div> <div><br> </div> <div>Also doing a further investigation it seems that the script that is ov= ercharguing the cpu is the weird.zeek =BFIs there a way to disable this scr= ipt?</div> <div><br> </div> <div><br> </div> <div>Thank you all for your replies.</div> <span></span><br> </div> <hr tabindex=3D"-1" style=3D"display:inline-block; width:98%"> <div id=3D"divRplyFwdMsg" dir=3D"ltr"><font face=3D"Calibri, sans-serif" co= lor=3D"#000000" style=3D"font-size:11pt"><b>De:</b> Justin Azoff <justin= @corelight.com><br> <b>Enviado:</b> mi=E9rcoles, 18 de diciembre de 2019 22:29<br> <b>Para:</b> Jorge Garc=EDa Rodr=EDguez <[email protected]>= <br> <b>Cc:</b> [email protected] <[email protected]><br> <b>Asunto:</b> Re: [Zeek] Zeek + PF_Ring Issue</font> <div> </div> </div> <div> <div dir=3D"ltr">Can you run bro-doctor: <a href=3D"https://packages.b= ro.org/packages/view/1251f948-f435-11e9-9321-0a645a3f3086">https://packages= .bro.org/packages/view/1251f948-f435-11e9-9321-0a645a3f3086</a> (works= with zeek, just didn't change the name). that will likely tell you what is wrong. You're probably not actually usi= ng pf_ring and should use the native plugin and not the pcap wrapper.</div> <br> <div class=3D"x_gmail_quote"> <div dir=3D"ltr" class=3D"x_gmail_attr">On Wed, Dec 18, 2019 at 5:31 AM Jor= ge Garc=EDa Rodr=EDguez <<a href=3D"mailto:[email protected]">= [email protected]</a>> wrote:<br> </div> <blockquote class=3D"x_gmail_quote" style=3D"margin:0px 0px 0px 0.8ex; bord= er-left:1px solid rgb(204,204,204); padding-left:1ex"> <div dir=3D"ltr"> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> Hi Zeekers!</div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> I need to resolve a problem attached to Zeek when its configured to work wi= th PF_Ring.</div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> The thing is that we receive between 1.0 and 2.5 GB/s in a fiber interface.= Also when we lauch the command "Zeekctl top" to check the Cpu us= age and the traffic managed in each worker, we see that the sum of the traf= fic of all workers is greater than the traffic we receive through the interface.</div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> This makes me think that we have something badly configured in PF_Ring or s= omehow Zeek is generating some kind of loop.<br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> For example, receiving 2Gb/s, i execute "Zeekctl top" and the res= ult is the next one:</div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> <span>Name Type Host = Pid VSize Rss Cpu &n= bsp; Cmd<br> </span> <div>logger logger localhost  = ; 11474 3G 118M 50% zeek<br> </div> <div>manager manager localhost &nb= sp;11520 589M 98M 25% zeek<br> </div> <div>proxy-1 proxy localhost  = ; 11565 610M 113M 18% zeek<br> </div> <div>worker-1-1 worker localhost 11= 693 1G 570M 62% zeek<br> </div> <div>worker-1-2 worker localhost 11= 701 1G 574M 62% zeek<br> </div> <div>worker-1-3 worker localhost 11= 711 1G 573M 68% zeek<br> </div> <div>worker-1-4 worker localhost 11= 713 1G 572M 50% zeek<br> </div> <div>worker-1-5 worker localhost 11= 718 3G 2G 106% zeek<br> </div> <div>worker-1-6 worker localhost 11= 719 1G 567M 62% zeek<br> </div> <div>worker-1-7 worker localhost 11= 726 1G 579M 68% zeek<br> </div> <div>worker-1-8 worker localhost 11= 732 1G 575M 56% zeek<br> </div> <div>worker-1-9 worker localhost 11= 733 1G 571M 68% zeek<br> </div> <div>worker-1-10 worker localhost 11= 735 1G 558M 62% zeek<br> </div> <span></span><br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> Hope someone of you can help me to resolve this.</div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> Really thank you.</div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> Best Regards!</div> </div> _______________________________________________<br> Zeek mailing list<br> <a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a><br> <a href=3D"http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek" rel=3D"n= oreferrer" target=3D"_blank">http://mailman.ICSI.Berkeley.EDU/mailman/listi= nfo/zeek</a></blockquote> </div> <br clear=3D"all"> <div><br> </div> -- <br> <div dir=3D"ltr" class=3D"x_gmail_signature"> <div dir=3D"ltr">Justin</div> </div> </div> </div> </div> </body> </html> --_000_AM0PR07MB42101F9158BF38B89FC2AE17EB520AM0PR07MB4210eurp_-- --===============0614072600== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek --===============0614072600==--