Doug Burks edited this page Mar 16, 2017 · 12 revisions


If you have multiple CPU cores, Setup will automatically ask you how many PF_RING instances you'd like for Snort/Suricata (IDS engine processes) and Bro and will tell you how to adjust after the fact. As of securityonion-setup - 20120912-0ubuntu0securityonion201, Setup should analyze your system and recommend a certain number of PF_RING instances:


If you want to change the number of PF_RING instances after running Setup, you can do the following.


  • Stop sensor processes:
    sudo nsm_sensor_ps-stop
  • Edit /etc/nsm/$HOSTNAME-$INTERFACE/sensor.conf and change the IDS_LB_PROCS variable to desired number of cores.
  • Start sensor processes:
    sudo nsm_sensor_ps-start

If running Snort, the script automatically spawns $IDS_LB_PROCS instances of Snort (using PF_RING), barnyard2, and snort_agent.

If running Suricata, the script automatically copies $IDS_LB_PROCS into suricata.yaml and then Suricata spins up the PF_RING instances itself.


For Bro, you would do the following:

  • Stop bro:
    sudo nsm_sensor_ps-stop --only-bro
  • Edit /opt/bro/etc/node.cfg and change the lb_procs variable to the desired number of cores.
  • Start bro:
    sudo nsm_sensor_ps-start --only-bro


If you've already run Setup and want to modify min_num_slots, you can manually create/edit /etc/modprobe.d/pf_ring.conf.

For example, to increase min_num_slots to 65534, do the following:
echo "options pf_ring transparent_mode=0 min_num_slots=65534" | sudo tee /etc/modprobe.d/pf_ring.conf

After creating/editing /etc/modprobe.d/pf_ring.conf, you'll need to reload the PF_RING module as follows (or just reboot):
sudo nsm_sensor_ps-stop sudo rmmod pf_ring
sudo nsm_sensor_ps-start


Please see the Upgrade page for notes on updating the PF_RING kernel module.

Clone this wiki locally
You can’t perform that action at this time.
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.
Press h to open a hovercard with more details.