Mailing List Archive

Hello NTOP users.

I'm looking for hints on running Suricata over PF_RING ZC with multiple receive threads.

I have it running in single threaded mode, but it doesn't want to startup with more than one thread.


One thread runs ok:

```
shoshin@pit6:~$ sudo suricata --pfring-int=zc:p1p1 --pfring-cluster-id=99 --pfring-cluster-type=cluster_flow -c /usr/local/etc/suricata/rcc/suricata-pfring-zc-v1.yaml --init-errors-fatal --runmode workers -v
2/7/2018 -- 13:04:02 - <Notice> - This is Suricata version 4.0.4 RELEASE
2/7/2018 -- 13:04:02 - <Info> - CPUs/cores online: 80
2/7/2018 -- 13:04:03 - <Info> - Running in live mode, activating unix socket
2/7/2018 -- 13:04:06 - <Info> - 38 rule files processed. 12462 rules successfully loaded, 0 rules failed
2/7/2018 -- 13:04:06 - <Info> - Threshold config parsed: 0 rule(s) found
2/7/2018 -- 13:04:06 - <Info> - 12467 signatures processed. 1168 are IP-only rules, 5189 are inspecting packet payload, 7608 inspect application layer, 0 are decoder event only
2/7/2018 -- 13:04:12 - <Info> - fast output device (regular) initialized: fast.log
2/7/2018 -- 13:04:12 - <Info> - eve-log output device (regular) initialized: eve.json
2/7/2018 -- 13:04:12 - <Info> - stats output device (regular) initialized: stats.log
2/7/2018 -- 13:04:12 - <Info> - Using flow cluster mode for PF_RING (iface zc:p1p1)
2/7/2018 -- 13:04:12 - <Info> - Going to use 1 thread(s)
#########################################################################
# ERROR: You do not seem to have a valid PF_RING ZC license 7.3.0.180618 for p1p1 [Intel 10/40 Gbit i40e family]
# ERROR: Please get one at http://shop.ntop.org/.
#########################################################################
# We're now working in demo mode with packet capture and
# transmission limited to 5 minutes
#########################################################################
2/7/2018 -- 13:04:13 - <Info> - ZC interface detected, not adding thread to cluster
2/7/2018 -- 13:04:13 - <Info> - RunModeIdsPfringWorkers initialised
2/7/2018 -- 13:04:13 - <Info> - Running in live mode, activating unix socket
2/7/2018 -- 13:04:13 - <Info> - Using unix socket file '/usr/local/var/run/suricata/suricata-command.socket'
2/7/2018 -- 13:04:13 - <Notice> - all 1 packet processing threads, 4 management threads initialized, engine started.
2/7/2018 -- 13:04:34 - <Warning> - [ERRCODE: SC_ERR_PF_RING_VLAN(302)] - no VLAN header in the raw packet. See #2355.
^C2/7/2018 -- 13:06:17 - <Notice> - Signal Received. Stopping engine.
2/7/2018 -- 13:07:49 - <Error> - [ERRCODE: SC_ERR_FATAL(171)] - Engine unable to disable detect thread - "FM#01". Killing engine
```

---

Two threads fails to start:

```
shoshin@pit6:~$ sudo suricata --pfring-int=zc:p1p1 --pfring-cluster-id=99 --pfring-cluster-type=cluster_flow -c /usr/local/etc/suricata/rcc/suricata-pfring-zc-v1.yaml --init-errors-fatal --runmode workers -v
2/7/2018 -- 13:01:01 - <Notice> - This is Suricata version 4.0.4 RELEASE
2/7/2018 -- 13:01:01 - <Info> - CPUs/cores online: 80
2/7/2018 -- 13:01:02 - <Info> - Running in live mode, activating unix socket
2/7/2018 -- 13:01:04 - <Info> - 38 rule files processed. 12462 rules successfully loaded, 0 rules failed
2/7/2018 -- 13:01:04 - <Info> - Threshold config parsed: 0 rule(s) found
2/7/2018 -- 13:01:05 - <Info> - 12467 signatures processed. 1168 are IP-only rules, 5189 are inspecting packet payload, 7608 inspect application layer, 0 are decoder event only
2/7/2018 -- 13:01:11 - <Info> - fast output device (regular) initialized: fast.log
2/7/2018 -- 13:01:11 - <Info> - eve-log output device (regular) initialized: eve.json
2/7/2018 -- 13:01:11 - <Info> - stats output device (regular) initialized: stats.log
2/7/2018 -- 13:01:11 - <Info> - Using flow cluster mode for PF_RING (iface zc:p1p1)
2/7/2018 -- 13:01:11 - <Info> - Going to use 2 thread(s)
#########################################################################
# ERROR: You do not seem to have a valid PF_RING ZC license 7.3.0.180618 for p1p1 [Intel 10/40 Gbit i40e family]
# ERROR: Please get one at http://shop.ntop.org/.
#########################################################################
# We're now working in demo mode with packet capture and
# transmission limited to 5 minutes
#########################################################################
2/7/2018 -- 13:01:12 - <Info> - ZC interface detected, not adding thread to cluster
#########################################################################
# ERROR: You do not seem to have a valid PF_RING ZC license 7.3.0.180618 for p1p1 [Intel 10/40 Gbit i40e family]
# ERROR: Please get one at http://shop.ntop.org/.
#########################################################################
2/7/2018 -- 13:01:14 - <Info> - ZC interface detected, not adding thread to cluster
2/7/2018 -- 13:01:14 - <Info> - RunModeIdsPfringWorkers initialised
2/7/2018 -- 13:01:14 - <Info> - Running in live mode, activating unix socket
2/7/2018 -- 13:01:14 - <Info> - Using unix socket file '/usr/local/var/run/suricata/suricata-command.socket'
2/7/2018 -- 13:01:14 - <Notice> - all 2 packet processing threads, 4 management threads initialized, engine started.
2/7/2018 -- 13:01:14 - <Error> - [ERRCODE: SC_ERR_PF_RING_OPEN(34)] - pfring_enable_ring failed returned -1
2/7/2018 -- 13:01:14 - <Error> - [ERRCODE: SC_ERR_FATAL(171)] - thread W#02-zc:p1p1 failed
```


I followed the instructions for configuring PF_RING for Suricata listed "Accelerating Suricata with PF_RING DNA"
https://www.ntop.org/pf_ring/accelerating-suricata-with-pf_ring-dna/

---

My PF_RING configuration in suricata-pfring-zc-v1.yaml is this:

```
# PF_RING configuration. for use with native PF_RING support
# for more info see http://www.ntop.org/products/pf_ring/
pfring:
# - interface: eth0
- interface: p1p1
# Number of receive threads (>1 will enable experimental flow pinned
# runmode)
# threads: 1
threads: 40
- interface: zc:p1p1
threads: 1

# Default clusterid. PF_RING will load balance packets based on flow.
# All threads/processes that will participate need to have the same
# clusterid.
cluster-id: 99

# Default PF_RING cluster type. PF_RING can load balance per flow.
# Possible values are cluster_flow or cluster_round_robin.
cluster-type: cluster_flow
# bpf filter for this interface
#bpf-filter: tcp
# Choose checksum verification mode for the interface. At the moment
# of the capture, some packets may be with an invalid checksum due to
# offloading to the network card of the checksum computation.
# Possible values are:
# - rxonly: only compute checksum for packets received by network card.
# - yes: checksum validation is forced
# - no: checksum validation is disabled
# - auto: suricata uses a statistical approach to detect when
# checksum off-loading is used. (default)
# Warning: 'checksum-validation' must be set to yes to have any validation
#checksum-checks: auto
# Second interface
#- interface: eth1
# threads: 3
# cluster-id: 93
# cluster-type: cluster_flow
# Put default values here
- interface: default
#threads: 2
```

Any hints would be appreciated.
Thx


--
Robert Cyphers
shoshin@fastmail.com
_______________________________________________
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc