Error load lb. bpf file when using load balancing for af-packet?

Help
1

system: ubuntu 18.04
kernel version: 5.4.0-66-generic
AF-PACKET IPS mode suricata.yaml configuration is as follows

  • interface: eth0
    threads: 16
    defrag: no
    cluster-type: cluster_ebpf
    ebpf-lb-file: /usr/libexec/suricata/ebpf/lb.bpf
    cluster-id: 98
    copy-mode: ips
    copy-iface: eth1
    buffer-size: 64535
    use-mmap: yes
  • interface: eth1
    threads: 16
    cluster-id: 97
    defrag: no
    cluster-type: cluster_ebpf
    ebpf-lb-file: /usr/libexec/suricata/ebpf/lb.bpf
    copy-mode: ips
    copy-iface: eth0
    buffer-size: 64535
    use-mmap: yes

The packet loss rate of af-packet ips mode is serious when a large amount of data is transmitted, so I plan to use EBPF load balancing.
The lb. BPF file I used was compiled by Suricata. Why do always show lb. bpf file error?

11
11741×234 34.7 KB

2

Can you post the bpf file?

3

Which libbpf version are you using? I got the same error when using 0.2 or 0.3 releases, but I manage to make suricata load de lb.bpf file when compiling with libbpf 0.1.1: Release libbpf v0.1.1 · libbpf/libbpf · GitHub

At the moment I am not able to configure Suricata properly to take advantage of this LB mechanism, but the bpf program is loaded. You can check if the program is loaded in the kernel using bpftool prog show
If I am not mistaken, It should display something like this:

282: socket_filter  name lb  tag aea71c9d2ee3224c  gpl
        loaded_at 2021-04-07T11:18:21+0200  uid 0
        xlated 1792B  jited 972B  memlock 4096B
286: socket_filter  name lb  tag aea71c9d2ee3224c  gpl
        loaded_at 2021-04-07T11:18:21+0200  uid 0
        xlated 1792B  jited 972B  memlock 4096B

Hope this helps.