<html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><style>body { line-height: 1.5; }blockquote { margin-top: 0px; margin-bottom: 0px; margin-left: 0.5em; }body { font-size: 10.5pt; font-family: 'Microsoft YaHei UI'; color: rgb(0, 0, 0); line-height: 1.5; }</style></head><body>
<div><span></span>Hi Eric</div><div><span style="color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"> </span><span style="background-color: transparent;">I used the new lb.c error report as shown below</span></div><div><span style="color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"> </span><span style="background-color: transparent;">No permissions? The figure lb.bpf is readable</span></div><div><br></div><div><img src="cid:_Foxmail.1@99e926e5-8026-f35c-5339-0da374605068" border="0"></div>
<div><br></div><hr style="width: 210px; height: 1px;" color="#b5c4df" size="1" align="left">
<div><span><div style="MARGIN: 10px; FONT-FAMILY: verdana; FONT-SIZE: 10pt"><div>mazhuang@17paipai.cn</div></div></span></div>
<blockquote style="margin-Top: 0px; margin-Bottom: 0px; margin-Left: 0.5em"><div> </div><div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm"><div style="PADDING-RIGHT: 8px; PADDING-LEFT: 8px; FONT-SIZE: 12px;FONT-FAMILY:tahoma;COLOR:#000000; BACKGROUND: #efefef; PADDING-BOTTOM: 8px; PADDING-TOP: 8px"><div><b>From:</b> <a href="mailto:eric@regit.org">Eric Leblond</a></div><div><b>Date:</b> 2018-09-18 21:24</div><div><b>To:</b> <a href="mailto:mazhuang@17paipai.cn">mazhuang@17paipai.cn</a>; <a href="mailto:petermanev@gmail.com">Peter Manev</a></div><div><b>CC:</b> <a href="mailto:oisf-users@lists.openinfosecfoundation.org">oisf-users</a></div><div><b>Subject:</b> Re: [Oisf-users] suricata 4.1 eBpf load balance</div></div></div><div><div>Hello,</div>
<div> </div>
<div>On Tue, 2018-09-18 at 21:14 +0800, mazhuang@17paipai.cn wrote:</div>
<div>> Hi Peter</div>
<div>> I'm using the suricata source code itself：</div>
<div>> https://github.com/OISF/suricata/blob/master/ebpf/lb.c</div>
<div> </div>
<div>This code do not support VLAN maybe this is your issue.</div>
<div> </div>
<div>I've pushed a new version with VLAN support:</div>
<div> </div>
<div>https://github.com/regit/suricata/tree/ebpf-update</div>
<div> </div>
<div>Can you give it a try ?</div>
<div> </div>
<div>You can or use the branch or copy the lb.c to your source tree.</div>
<div> </div>
<div>BR,</div>
<div>--</div>
<div>Eric Leblond</div>
<div> </div>
<div>> </div>
<div>> mazhuang@17paipai.cn</div>
<div>> > </div>
<div>> > From: Peter Manev</div>
<div>> > Date: 2018-09-18 21:12</div>
<div>> > To: mazhuang</div>
<div>> > CC: Open Information Security Foundation</div>
<div>> > Subject: Re: [Oisf-users] suricata 4.1 eBpf load balance</div>
<div>> > On Tue, Sep 18, 2018 at 2:48 PM mazhuang@17paipai.cn</div>
<div>> > <mazhuang@17paipai.cn> wrote:</div>
<div>> > ></div>
<div>> > > Hi All</div>
<div>> > > I followed </div>
<div>> > https://suricata.readthedocs.io/en/latest/capture-hardware/ebpf-xdp.html#setup-ebpf-load-balancing</div>
<div>> > this tutorial to configure ebpf load balancing, but the result was</div>
<div>> > only one core processing the data</div>
<div>> > ></div>
<div>> > ></div>
<div>> > > Suricata Version:4.1</div>
<div>> > > OS:Centos 7</div>
<div>> > > Kernel:Linux yg 4.18.8-1.el7.elrepo.x86_64 #1 SMP Sat Sep 15</div>
<div>> > 10:10:09 EDT 2018 x86_64 x86_64 x86_64 GNU/Linux</div>
<div>> > > CPU:Intel(R) Xeon(R) CPU E5-2640 v4 @ 2.40GHz x2</div>
<div>> > > Memory:128G</div>
<div>> > </div>
<div>> > </div>
<div>> > Can you share your balancer (lb.bpf) so i can try to reproduce?</div>
<div>> > </div>
<div>> > </div>
<div>> > </div>
<div>> > --</div>
<div>> > Regards,</div>
<div>> > Peter Manev</div>
<div>> > </div>
<div>> </div>
<div>> _______________________________________________</div>
<div>> Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org</div>
<div>> Site: http://suricata-ids.org | Support: </div>
<div>> http://suricata-ids.org/support/</div>
<div>> List: </div>
<div>> https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</div>
<div>> </div>
<div>> Conference: https://suricon.net</div>
<div>> Trainings: https://suricata-ids.org/training/</div>
<div>-- </div>
<div>Eric Leblond <eric@regit.org></div>
<div> </div>
</div></blockquote>
</body></html>