Hi Alicia after configuring RSS in your load_dna_driver.sh script, you should use dnaX@Y to open the rss queue Y on dnaX
Alfredo On 12 Apr 2014, at 21:37, Alicia Smith <[email protected]> wrote: > Do you know of any good documentation I could use online on how to do #1? > > I already tried to set RSS to 2 for the specific interface I needed another > queue on, but still resulted in the errors below. > > Alicia S. > ________________________________________ > From: [email protected] > [[email protected]] On Behalf Of Alfredo Cardigliano > [[email protected]] > Sent: Saturday, April 12, 2014 10:11 AM > To: [email protected] > Subject: Re: [Ntop-misc] Question about multiple snort processes > > Hi Alicia > standard pf_ring clustering is not supported by dna, and you cannot open the > same dna interface from multiple application. > This means the you have 2 options: > 1. use RSS and open a queue per snort instance > 2. use the Libzero DNA Cluster (see pfdnacluster_master app in examples), and > open a consumer queue per snort instance > > Best Regards > Alfredo > > On 12 Apr 2014, at 16:56, Alicia Smith <[email protected]> wrote: > >> Good Morning! >> >> So I am trying to use more than one snort process per interface, while I can >> tie a single snort process to a particular cpu, I can't seem to run multiple >> snort processes on a single interface and tie them to multiple cpu's with my >> current configuration. >> >> If I attempt to use a "clusterid=" daq variable - I get the following: >> Apr 12 14:42:53 DFW01-NIDS snort[3420]: pfring_dna DAQ configured to passive. >> Apr 12 14:42:53 DFW01-NIDS snort[3420]: FATAL ERROR: Can't initialize DAQ >> pfring_dna (-1) - pfring_daq_initialize: unsupported >> variable(clusterid=2)#012 >> >> >> without the cluster variable in the startup script I get this error: >> >> Apr 12 14:51:20 DFW01-NIDS snort[4981]: FATAL ERROR: Can't initialize DAQ >> pfring_dna (-1) - >> Apr 12 14:51:20 DFW01-NIDS kernel: [PF_RING] Unable to activate two or more >> DNA sockets on the same interface dna1/link direction >> >> >> Could someone please point me in the right direction? Was I supposed to >> compile with a certain option? >> >> Thank you in advance! >> >> Alicia S. >> _______________________________________________ >> Ntop-misc mailing list >> [email protected] >> http://listgateway.unipi.it/mailman/listinfo/ntop-misc > > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
