[Oisf-users] suricata 4.1 eBpf load balance

[Eric Leblond]

Hello,

On Tue, 2018-09-18 at 21:14 +0800, mazhuang at 17paipai.cn wrote:
> Hi Peter
>     I'm using the suricata source code itself：
> https://github.com/OISF/suricata/blob/master/ebpf/lb.c

This code do not support VLAN maybe this is your issue.

I've pushed a new version with VLAN support:

https://github.com/regit/suricata/tree/ebpf-update

Can you give it a try ?

You can or use the branch or copy the lb.c to your source tree.

BR,
--
Eric Leblond

> 
> mazhuang at 17paipai.cn
> >  
> > From: Peter Manev
> > Date: 2018-09-18 21:12
> > To: mazhuang
> > CC: Open Information Security Foundation
> > Subject: Re: [Oisf-users] suricata 4.1 eBpf load balance
> > On Tue, Sep 18, 2018 at 2:48 PM mazhuang at 17paipai.cn
> > <mazhuang at 17paipai.cn> wrote:
> > >
> > > Hi All
> > >     I followed 
> > https://suricata.readthedocs.io/en/latest/capture-hardware/ebpf-xdp.html#setup-ebpf-load-balancing
> >  this tutorial to configure ebpf load balancing, but the result was
> > only one core processing the data
> > >
> > >
> > >     Suricata Version:4.1
> > >     OS:Centos 7
> > >     Kernel:Linux yg 4.18.8-1.el7.elrepo.x86_64 #1 SMP Sat Sep 15
> > 10:10:09 EDT 2018 x86_64 x86_64 x86_64 GNU/Linux
> > >     CPU:Intel(R) Xeon(R) CPU E5-2640 v4 @ 2.40GHz x2
> > >     Memory:128G
> >  
> >  
> > Can you share your balancer (lb.bpf) so i can try to reproduce?
> >  
> >  
> >  
> > --
> > Regards,
> > Peter Manev
> >  
> 
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: 
> http://suricata-ids.org/support/
> List: 
> https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> 
> Conference: https://suricon.net
> Trainings: https://suricata-ids.org/training/
-- 
Eric Leblond <eric at regit.org>