Expensive or not it's far from 50% packet loss. I know that one can see everything that's processing packets as expensive, but at the end of a day, that is why we use pf_ring, not to capture packets with 0% loss at 10Gbit and send them to > /dev/null (and that's how I see most pure pf_ring benchmarks are done).
Your hardware seems to be very old and lacking all of the important performance optimisations - E5405 is not something one would typically use. 300-400Mbit per second is not a problem with pf_ring and Bro, I have 1-2Gbit and 0% loss (pf_ring without ZC) up to 4-5Gbit/sec (but with a different technology than pf_ring). On Fri, Sep 11, 2015 at 12:36 PM, Alfredo Cardigliano <[email protected]> wrote: > Hi > in our test we’ve seend that packet processing in Bro is very expensive, I > do not think you can improve significantly tuning the pf_ring side. > > Alfredo > > On 11 Sep 2015, at 20:52, nathanael rayborn <[email protected]> > wrote: > > I'm experiencing high packet loss (15% -50%) with Bro 2.4 compiled with > PF_Ring. PFcount (pfcount -i eth0 -e 1) shows 0% packet loss while > /proc/net/pf_ring/PID shows the same number of dropped packets as broctl > netstats. The github link contains all changes and performance steps I've > taken so far along with output from PFcount, broctl, and ethtool. Has anyone > else experienced similar performance issues or have recommendations to get > my dropped packets as close to 0% as possible? Thanks > > Current config - https://gist.github.com/nate-ray/8b4d03eab49d11715398 > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > > > > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
