Skip to content

Latest commit

 

History

History
75 lines (43 loc) · 1.96 KB

pf-ring.rst

File metadata and controls

75 lines (43 loc) · 1.96 KB

PF-RING

PF-RING acts as a flow-based load balancer to allow us to spin up multiple instances of Snort/Suricata/Zeek to handle more traffic than a single instance.

Starting in securityonion-setup - 20120912-0ubuntu0securityonion285, running Setup will configure Suricata and Zeek to use AF-PACKET instead of PF-RING.

Tuning

If you want to change the number of PF-RING instances after running Setup, you can do the following.

Snort/Suricata

To change the number of PF-RING instances for Snort or Suricata:

  • Stop sensor processes:

    sudo so-sensor-stop

  • Edit /etc/nsm/$HOSTNAME-$INTERFACE/sensor.conf and change the IDS_LB_PROCS variable to desired number of cores.

  • Start sensor processes:

    sudo so-sensor-start

If running Snort, so-sensor-start automatically spawns $IDS_LB_PROCS instances of Snort (using PF-RING), barnyard2, and snort_agent.

If running Suricata, so-sensor-start automatically copies $IDS_LB_PROCS into suricata.yaml and then Suricata spins up the PF-RING instances itself.

Zeek

To change the number of PF-RING instances for Zeek:

  • Stop zeek:

    sudo so-zeek-stop

  • Edit /opt/bro/etc/node.cfg and change the lb_procs variable to the desired number of cores.

  • Start zeek:

    sudo so-zeek-start

Slots

If you've already run Setup and want to modify min_num_slots, you can manually create/edit /etc/modprobe.d/pf_ring.conf.

For example, to increase min_num_slots to 65534, do the following:

echo "options pf_ring transparent_mode=0 min_num_slots=65534" | sudo tee /etc/modprobe.d/pf_ring.conf

After creating/editing /etc/modprobe.d/pf_ring.conf, you'll need to reload the PF-RING module as follows (or just reboot):

sudo so-sensor-stop
sudo rmmod pf_ring
sudo so-sensor-start

Updating

Please see the Upgrade section for notes on updating the PF-RING kernel module.