Hey @Andreas_Herz … Extremely confused,
18/10/2022 -- 19:52:05 - <Info> - All AFP capture threads are running.
19/10/2022 -- 00:00:34 - <Notice> - Signal Received. Stopping engine.
19/10/2022 -- 00:00:35 - <Perf> - 0 new flows, 0 established flows were timed out, 0 flows in closed state
19/10/2022 -- 00:00:35 - <Info> - time elapsed 14914.397s
19/10/2022 -- 00:00:35 - <Perf> - 21 flows processed
19/10/2022 -- 00:00:36 - <Perf> - (W#01-bond0) Kernel: Packets 0, dropped 0
..
19/10/2022 -- 00:00:40 - <Info> - Alerts: 5
19/10/2022 -- 00:00:40 - <Perf> - ippair memory usage: 414144 bytes, maximum: 16777216
19/10/2022 -- 00:00:41 - <Perf> - host memory usage: 398144 bytes, maximum: 33554432
19/10/2022 -- 00:00:41 - <Info> - cleaning up signature grouping structure... complete
19/10/2022 -- 00:00:41 - <Notice> - Stats for 'bond0': pkts: 221, drop: 0 (0.00%), invalid chksum: 0
19/10/2022 -- 00:00:41 - <Perf> - bond0: restoring gro offloading
19/10/2022 -- 00:00:41 - <Perf> - bond0: restoring tso offloading
19/10/2022 -- 00:00:41 - <Perf> - bond0: restoring gso offloading
19/10/2022 -- 00:00:41 - <Perf> - bond0: restoring sg offloading
19/10/2022 -- 00:00:41 - <Perf> - bond0: restoring lro offloading
19/10/2022 -- 00:00:41 - <Warning> - [ERRCODE: SC_ERR_SYSCALL(50)] - Failure when trying to set feature via ioctl for 'bond0': Invalid argument (22)
19/10/2022 -- 00:00:41 - <Perf> - Cleaning up Hyperscan global scratch
19/10/2022 -- 00:00:41 - <Perf> - Clearing Hyperscan database cache
19/10/2022 -- 00:00:42 - <Notice> - This is Suricata version 6.0.8 RELEASE running in SYSTEM mode
..
19/10/2022 -- 00:00:42 - <Info> - CPUs/cores online: 80
19/10/2022 -- 00:00:42 - <Config> - Adding interface bond0 from config file
19/10/2022 -- 00:00:42 - <Config> - luajit states preallocated: 128
19/10/2022 -- 00:00:42 - <Config> - app-layer.error-policy: ignore
19/10/2022 -- 00:00:42 - <Config> - 'default' server has 'request-body-minimal-inspect-size' set to 33868 and 'request-body-inspect-window' set to 3931 after randomization.
19/10/2022 -- 00:00:42 - <Config> - 'default' server has 'response-body-minimal-inspect-size' set to 40121 and 'response-body-inspect-window' set to 16474 after randomization.
19/10/2022 -- 00:00:42 - <Config> - SMB stream depth: 0
19/10/2022 -- 00:00:42 - <Config> - SMB max-read-size: 0
19/10/2022 -- 00:00:42 - <Config> - SMB max-write-size: 0
19/10/2022 -- 00:00:42 - <Config> - SMB max-write-queue-size: 0
19/10/2022 -- 00:00:42 - <Config> - SMB max-write-queue-cnt: 0
19/10/2022 -- 00:00:42 - <Config> - SMB max-read-queue-size: 0
19/10/2022 -- 00:00:42 - <Config> - SMB max-read-queue-cnt: 0
19/10/2022 -- 00:00:42 - <Config> - Protocol detection and parser disabled for modbus protocol.
19/10/2022 -- 00:00:42 - <Config> - Protocol detection and parser disabled for enip protocol.
19/10/2022 -- 00:00:42 - <Config> - Protocol detection and parser disabled for DNP3.
19/10/2022 -- 00:00:42 - <Warning> - [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - App-Layer protocol sip enable status not set, so enabling by default. This behavior will change in Suricata 7, so please update your config. See ticket #4744 for more details.
..
19/10/2022 -- 00:00:42 - <Info> - Found an MTU of 1500 for 'bond0'
19/10/2022 -- 00:00:42 - <Info> - Found an MTU of 1500 for 'bond0'
19/10/2022 -- 00:00:42 - <Config> - allocated 262144 bytes of memory for the host hash... 4096 buckets of size 64
19/10/2022 -- 00:00:42 - <Config> - preallocated 1000 hosts of size 136
19/10/2022 -- 00:00:42 - <Config> - host memory usage: 398144 bytes, maximum: 33554432
19/10/2022 -- 00:00:42 - <Config> - Core dump size set to unlimited.
19/10/2022 -- 00:00:42 - <Config> - defrag.memcap-policy: ignore
..
19/10/2022 -- 03:29:54 - <Perf> - bond0: disabling sg offloading
19/10/2022 -- 03:29:54 - <Config> - bond0: enabling zero copy mode by using data release call
19/10/2022 -- 03:29:54 - <Info> - Going to use 80 thread(s)
19/10/2022 -- 03:29:55 - <Config> - using 1 flow manager threads
19/10/2022 -- 03:29:55 - <Config> - using 1 flow recycler threads
19/10/2022 -- 03:29:55 - <Info> - Running in live mode, activating unix socket
19/10/2022 -- 03:29:55 - <Info> - Using unix socket file '/var/run/suricata/suricata-command.socket'
19/10/2022 -- 03:29:55 - <Notice> - all 80 packet processing threads, 4 management threads initialized, engine started.
19/10/2022 -- 03:29:55 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:55 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:55 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:55 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:55 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:55 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:55 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:56 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:56 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:56 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:56 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:56 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:56 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:56 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:56 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:56 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:56 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:56 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:56 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:56 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:56 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:56 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:56 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:56 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:56 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:57 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:57 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:57 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:57 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:57 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:57 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:57 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:57 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:57 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:57 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:57 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:57 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:57 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:57 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:57 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:57 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:57 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:57 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:58 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:58 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:58 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:58 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:58 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:58 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:58 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:58 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:58 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:58 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:58 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:58 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:58 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:58 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:58 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:58 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:58 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:58 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:58 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:58 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:58 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:58 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:58 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:59 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:59 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:59 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:59 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:59 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:59 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:59 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:59 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:59 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:59 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:59 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:59 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:59 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:59 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=2 frame_size=1600 frame_nr=40
19/10/2022 -- 03:29:59 - <Info> - All AFP capture threads are running.
19/10/2022 -- 03:36:54 - <Notice> - Signal Received. Stopping engine.
19/10/2022 -- 03:36:55 - <Perf> - 0 new flows, 0 established flows were timed out, 0 flows in closed state
19/10/2022 -- 03:36:55 - <Info> - time elapsed 420.791s
19/10/2022 -- 03:36:55 - <Perf> - 0 flows processed
..
19/10/2022 -- 03:37:18 - <Error> - [ERRCODE: SC_ERR_MEM_ALLOC(1)] - failed to setup/expand stream session pool. Expand stream.memcap?
19/10/2022 -- 03:37:18 - <Error> - [ERRCODE: SC_ERR_POOL_INIT(66)] - alloc error
19/10/2022 -- 03:37:18 - <Error> - [ERRCODE: SC_ERR_POOL_INIT(66)] - pool grow failed
19/10/2022 -- 03:37:18 - <Error> - [ERRCODE: SC_ERR_MEM_ALLOC(1)] - failed to setup/expand stream session pool. Expand stream.memcap?
19/10/2022 -- 03:37:18 - <Error> - [ERRCODE: SC_ERR_POOL_INIT(66)] - alloc error
19/10/2022 -- 03:37:18 - <Error> - [ERRCODE: SC_ERR_POOL_INIT(66)] - pool grow failed
19/10/2022 -- 03:37:18 - <Error> - [ERRCODE: SC_ERR_MEM_ALLOC(1)] - failed to setup/expand stream session pool. Expand stream.memcap?
..
19/10/2022 -- 03:37:18 - <Info> - Running in live mode, activating unix socket
19/10/2022 -- 03:37:18 - <Info> - Using unix socket file '/var/run/suricata/suricata-command.socket'
19/10/2022 -- 03:37:18 - <Error> - [ERRCODE: SC_ERR_THREAD_INIT(49)] - thread "W#31-eno1np0" failed to initialize: flags 0145
19/10/2022 -- 03:37:18 - <Error> - [ERRCODE: SC_ERR_FATAL(171)] - Engine initialization failed, aborting...
19/10/2022 -- 03:41:29 - <Notice> - This is Suricata version 6.0.8 RELEASE running in SYSTEM mode
19/10/2022 -- 03:41:29 - <Info> - CPUs/cores online: 80
19/10/2022 -- 03:41:29 - <Config> - Adding interface bond0 from config file
19/10/2022 -- 03:41:29 - <Config> - Adding interface eno1np0 from config file
19/10/2022 -- 03:41:29 - <Config> - Adding interface eno2np0 from config file
19/10/2022 -- 03:41:29 - <Config> - luajit states preallocated: 128
19/10/2022 -- 03:41:29 - <Config> - app-layer.error-policy: ignore
19/10/2022 -- 03:41:29 - <Config> - 'default' server has 'request-body-minimal-inspect-size' set to 32202 and 'request-body-inspect-window' set to 3980 after randomization.
19/10/2022 -- 03:41:29 - <Config> - 'default' server has 'response-body-minimal-inspect-size' set to 42427 and 'response-body-inspect-window' set to 15704 after randomization
..
19/10/2022 -- 15:33:16 - <Config> - using 1 flow manager threads
19/10/2022 -- 15:33:16 - <Config> - using 1 flow recycler threads
19/10/2022 -- 15:33:16 - <Info> - Using unix socket file '/var/run/suricata/suricata-command.socket'
19/10/2022 -- 15:33:16 - <Error> - [ERRCODE: SC_ERR_THREAD_INIT(49)] - thread "W#31-eno1np0" failed to initialize: flags 0145
19/10/2022 -- 15:33:16 - <Error> - [ERRCODE: SC_ERR_FATAL(171)] - Engine initialization failed, aborting...
at /etc/suricata/suricata.yaml | grep bond0 -A 50 -B 5
## and PF_RING.
##
# Linux high speed capture support
af-packet:
- interface: bond0
# Number of receive threads. "auto" uses the number of cores
#threads: auto
# Default clusterid. AF_PACKET will load balance packets based on flow.
cluster-id: 99
# Default AF_PACKET cluster type. AF_PACKET can load balance per flow or per hash.
# This is only supported for Linux kernel > 3.1
# possible value are:
# * cluster_flow: all packets of a given flow are sent to the same socket
# * cluster_cpu: all packets treated in kernel by a CPU are sent to the same socket
# * cluster_qm: all packets linked by network card to a RSS queue are sent to the same
# socket. Requires at least Linux 3.14.
# * cluster_ebpf: eBPF file load balancing. See doc/userguide/capture-hardware/ebpf-xdp.rst for
# more info.
# Recommended modes are cluster_flow on most boxes and cluster_cpu or cluster_qm on system
# with capture card using RSS (requires cpu affinity tuning and system IRQ tuning)
cluster-type: cluster_flow
# In some fragmentation cases, the hash can not be computed. If "defrag" is set
# to yes, the kernel will do the needed defragmentation before sending the packets.
defrag: yes
# To use the ring feature of AF_PACKET, set 'use-mmap' to yes
#use-mmap: yes
# Lock memory map to avoid it being swapped. Be careful that over
# subscribing could lock your system
#mmap-locked: yes
# Use tpacket_v3 capture mode, only active if use-mmap is true
# Don't use it in IPS or TAP mode as it causes severe latency
#tpacket-v3: yes
# Ring size will be computed with respect to "max-pending-packets" and number
# of threads. You can set manually the ring size in number of packets by setting
# the following value. If you are using flow "cluster-type" and have really network
# intensive single-flow you may want to set the "ring-size" independently of the number
# of threads:
#ring-size: 2048
# Block size is used by tpacket_v3 only. It should set to a value high enough to contain
# a decent number of packets. Size is in bytes so please consider your MTU. It should be
# a power of 2 and it must be multiple of page size (usually 4096).
#block-size: 32768
# tpacket_v3 block timeout: an open block is passed to userspace if it is not
# filled after block-timeout milliseconds.
#block-timeout: 10
# On busy systems, set it to yes to help recover from a packet drop
# phase. This will result in some packets (at max a ring flush) not being inspected.
#use-emergency-flush: yes
# recv buffer size, increased value could improve performance
# buffer-size: 32768
# Set to yes to disable promiscuous mode
# disable-promisc: no
# Choose checksum verification mode for the interface. At the moment
# of the capture, some packets may have an invalid checksum due to
# the checksum computation being offloaded to the network card.
--
#copy-iface: eth1
# For eBPF and XDP setup including bypass, filter and load balancing, please
# see doc/userguide/capture-hardware/ebpf-xdp.rst for more info.
- interface: eno1np0
# Adding additional interface eno1np0 which is part of bond0 interface ($ ip link show)
# Number of receive threads. "auto" uses the number of cores
#threads: auto
# Default clusterid. AF_PACKET will load balance packets based on flow.
cluster-id: 98
# Default AF_PACKET cluster type. AF_PACKET can load balance per flow or per hash.
# This is only supported for Linux kernel > 3.1
# possible value are:
# * cluster_flow: all packets of a given flow are sent to the same socket
# * cluster_cpu: all packets treated in kernel by a CPU are sent to the same socket
# * cluster_qm: all packets linked by network card to a RSS queue are sent to the same
# socket. Requires at least Linux 3.14.
# * cluster_ebpf: eBPF file load balancing. See doc/userguide/capture-hardware/ebpf-xdp.rst for
# more info.
# Recommended modes are cluster_flow on most boxes and cluster_cpu or cluster_qm on system
# with capture card using RSS (requires cpu affinity tuning and system IRQ tuning)
cluster-type: cluster_flow
# In some fragmentation cases, the hash can not be computed. If "defrag" is set
# to yes, the kernel will do the needed defragmentation before sending the packets.
defrag: yes
# To use the ring feature of AF_PACKET, set 'use-mmap' to yes
#use-mmap: yes
# Lock memory map to avoid it being swapped. Be careful that over
# subscribing could lock your system
#mmap-locked: yes
# Use tpacket_v3 capture mode, only active if use-mmap is true
# Don't use it in IPS or TAP mode as it causes severe latency
#tpacket-v3: yes
# Ring size will be computed with respect to "max-pending-packets" and number
# of threads. You can set manually the ring size in number of packets by setting
# the following value. If you are using flow "cluster-type" and have really network
# intensive single-flow you may want to set the "ring-size" independently of the number
# of threads:
#ring-size: 2048
# Block size is used by tpacket_v3 only. It should set to a value high enough to contain
# a decent number of packets. Size is in bytes so please consider your MTU. It should be
# a power of 2 and it must be multiple of page size (usually 4096).
#block-size: 32768
# tpacket_v3 block timeout: an open block is passed to userspace if it is not
# filled after block-timeout milliseconds.
#block-timeout: 10
# On busy systems, set it to yes to help recover from a packet drop
# phase. This will result in some packets (at max a ring flush) not being inspected.
#use-emergency-flush: yes
# recv buffer size, increased value could improve performance
# buffer-size: 32768
# Set to yes to disable promiscuous mode
# disable-promisc: no
# Choose checksum verification mode for the interface. At the moment
# of the capture, some packets may have an invalid checksum due to
# the checksum computation being offloaded to the network card.
--
#copy-iface: eth1
# For eBPF and XDP setup including bypass, filter and load balancing, please
# see doc/userguide/capture-hardware/ebpf-xdp.rst for more info.
- interface: eno2np0
# Adding additional interface eno2np0 which is part of bond0 interface ($ ip link show)
# Number of receive threads. "auto" uses the number of cores
#threads: auto
# Default clusterid. AF_PACKET will load balance packets based on flow.
cluster-id: 97
# Default AF_PACKET cluster type. AF_PACKET can load balance per flow or per hash.
# This is only supported for Linux kernel > 3.1
# possible value are:
# * cluster_flow: all packets of a given flow are sent to the same socket
# * cluster_cpu: all packets treated in kernel by a CPU are sent to the same socket
# * cluster_qm: all packets linked by network card to a RSS queue are sent to the same
# socket. Requires at least Linux 3.14.
# * cluster_ebpf: eBPF file load balancing. See doc/userguide/capture-hardware/ebpf-xdp.rst for
# more info.
# Recommended modes are cluster_flow on most boxes and cluster_cpu or cluster_qm on system
# with capture card using RSS (requires cpu affinity tuning and system IRQ tuning)
cluster-type: cluster_flow
# In some fragmentation cases, the hash can not be computed. If "defrag" is set
# to yes, the kernel will do the needed defragmentation before sending the packets.
defrag: yes
# To use the ring feature of AF_PACKET, set 'use-mmap' to yes
#use-mmap: yes
# Lock memory map to avoid it being swapped. Be careful that over
# subscribing could lock your system
#mmap-locked: yes
# Use tpacket_v3 capture mode, only active if use-mmap is true
# Don't use it in IPS or TAP mode as it causes severe latency
#tpacket-v3: yes
# Ring size will be computed with respect to "max-pending-packets" and number
# of threads. You can set manually the ring size in number of packets by setting
# the following value. If you are using flow "cluster-type" and have really network
# intensive single-flow you may want to set the "ring-size" independently of the number
# of threads:
#ring-size: 2048
# Block size is used by tpacket_v3 only. It should set to a value high enough to contain
# a decent number of packets. Size is in bytes so please consider your MTU. It should be
# a power of 2 and it must be multiple of page size (usually 4096).
#block-size: 32768
# tpacket_v3 block timeout: an open block is passed to userspace if it is not
# filled after block-timeout milliseconds.
#block-timeout: 10
# On busy systems, set it to yes to help recover from a packet drop
# phase. This will result in some packets (at max a ring flush) not being inspected.
#use-emergency-flush: yes
# recv buffer size, increased value could improve performance
# buffer-size: 32768
# Set to yes to disable promiscuous mode
# disable-promisc: no
# Choose checksum verification mode for the interface. At the moment
# of the capture, some packets may have an invalid checksum due to
# the checksum computation being offloaded to the network card.
..
Do I need to amend some config somewhere? This does seem to be related IMO
It doesn’t seem to be supporting/picking up multiple interfaces from the config file by looking at the logs.
OR, does the format need to be like in the config file: (separating the - interface
with af-packet
segment?)
**af-packet:**
- interface: bond0
<snip options>
cluster-id: 99
**af-packet:**
-interface: eno1np0
<snip options>
cluster-id: 98
**af-packet:**
-interface: eno1np0
<snip options>
cluster-id: 97
TYIA!