PF_RING

Setup

Setup will automatically ask you how many PF_RING instances (IDS engine processes) you'd like for Snort/Suricata and Bro (assuming you have multiple cores) and will tell you how to adjust after the fact.

Tuning

If you want to change the number of PF_RING instances after running Setup, you can do the following.

Snort/Suricata

• Stop sensor processes:

sudo nsm_sensor_ps-stop

• Edit /etc/nsm/$HOSTNAME-$INTERFACE/sensor.conf and change the IDS_LB_PROCS variable to desired number of cores.
• Start sensor processes:

sudo nsm_sensor_ps-start

If running Snort, the script automatically spawns $IDS_LB_PROCS instances of Snort (using PF_RING), barnyard2, and snort_agent.
If running Suricata, the script automatically copies $IDS_LB_PROCS into
suricata.yaml and then Suricata spins up the PF_RING instances itself.

Bro

For Bro, you would do the following:

• Stop bro:
  

  sudo nsm_sensor_ps-stop --only-bro
  
  

• Edit /opt/bro/etc/node.cfg and change the lb_procs variable to the desired number of cores.
  
• Start bro:
  

  sudo nsm_sensor_ps-start --only-bro
  
  

#### Updating #### Please see the [Upgrade](Upgrade) page for notes on updating the PF_RING kernel module.