Justin Via the pfring DAQ we inject drop rules in the kernel whenever snort detects bad traffic. It might be that these rules are causing the problem you see as all the rules are removed when you restart snort. Can you please check what traffic is dropped and verify if my feelings are correct?
regards Luca Sent from my iPad (sorry for typos) On 29/feb/2012, at 16:05, Justin Azoff <[email protected]> wrote: > Hello, > > I have a box running this version of pf_ring > > [PF_RING] Welcome to PF_RING 5.2.3 ($Revision: 5172$) > (C) 2004-11 L.Deri <[email protected]> > [PF_RING] registered /proc/net/pf_ring/ > NET: Registered protocol family 27 > [PF_RING] Min # ring slots 4096 > [PF_RING] Slot version 13 > [PF_RING] Capture TX No [RX only] > [PF_RING] Transparent Mode 0 > [PF_RING] IP Defragment No > [PF_RING] Initialized correctly > > I'm mainly using it for the cluster load balancing support. Traffic > levels are only around 100 Kpps. > > The box is currently running the following: > > * 2x snort processes using pf_ring daq in a cluster > * 1x tcpdump process using the pf_ring tcpdump > * a handful of other applications using standard libpcap not yet > re-built against pf_ring > > Things are working well except that I noticed after about a day the > traffic levels reported by the box start to drop off until they get down > to about 100mbit. The interesting thing is that killing and restarting > the two snort processes causes the traffic levels to bounce back. > > Attached is a graph from munin showing the rx bytes on the capture > interface. Keep in mind the Y axis is upside down. It should look > something like a sine wave, but you can see starting around midnight on > tuesday it begins to drop off until I restarted snort around 12:00. > Once I did that the traffic jumped back to almost 600mbit. The munin > monitor uses /proc/net/dev, so it's not measuring capture performance > itself. > > The box is a bit overloaded (it is being replaced in a few weeks) but > I'm not sure if that could explain this problem. > > > -- > -- Justin Azoff > -- Network Security & Performance Analyst > <pf_ring_traffic_problem.png> > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
