From owner-freebsd-net@FreeBSD.ORG Fri Jul 11 20:52:08 2008 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 6D47810656E4 for ; Fri, 11 Jul 2008 20:52:08 +0000 (UTC) (envelope-from robin@icir.org) Received: from fruitcake.ICSI.Berkeley.EDU (fruitcake.ICSI.Berkeley.EDU [192.150.186.11]) by mx1.freebsd.org (Postfix) with ESMTP id 6864C8FC0C for ; Fri, 11 Jul 2008 20:52:08 +0000 (UTC) (envelope-from robin@icir.org) Received: from empire.ICSI.Berkeley.EDU (empire.ICSI.Berkeley.EDU [192.150.186.169]) by fruitcake.ICSI.Berkeley.EDU (8.12.11.20060614/8.12.11) with ESMTP id m6BKRgZD025281; Fri, 11 Jul 2008 13:27:42 -0700 (PDT) Received: by empire.ICSI.Berkeley.EDU (Postfix, from userid 502) id C4B59E0F8CD; Fri, 11 Jul 2008 13:27:37 -0700 (PDT) Date: Fri, 11 Jul 2008 13:27:37 -0700 From: Robin Sommer To: freebsd-net@freebsd.org Message-ID: <20080711202737.GB27418@icir.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.17 (2007-11-01) Cc: Subject: BPF problems on FreeBSD 7.0 X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Jul 2008 20:52:08 -0000 Hi all, we're seeing some strange effects with our libpcap-based application (the Bro network intrusion detection system) on a FreeBSD 7-RELEASE system. As the application has always been running fine on 6.x, we're wondering whether this might be triggered by any of the changes that went into 7. The problem is that the Bro process, after running fine for a few hours or so, regularly stalls completely; the process seems to enter some odd state, using 0% CPU and with top showing only an empty field in the STATE column. We saw this effect with a Neterion network card and first thought it might be a driver problem. After switching to an Intel card, we see something slightly different: now the process doesn't stall completely anymore but it still gets to some point at which it stops receiving packets from libpcap. We haven't yet seen these problems with any other libpcap application. The only difference between Bro and most other libpcap applications that I can think of right now, is that Bro is using select() on the file descriptor. However, with a small test applicaton which mimics Bro's way of using libpcap, we couldn't reproduce the problem so far either. With the Neterion card, we have also tried disabling LRO and MSI explicitly but to no avail. Again, this is all with a Bro installation that works fine when running FreeBSD 6.x (we haven't run 6.x on the same boxes but we see the problems on two separate machines running FreeBSD 7). I'm wondering whether anybody here has seen something similar or might have an idea where to start looking for the cause. Any ideas? Thanks, Robin -- Robin Sommer * Phone +1 (510) 666-2886 * robin@icir.org ICSI/LBNL * Fax +1 (510) 666-2956 * www.icir.org