PF_RING

Setup

If you have multiple CPU cores, Setup will automatically ask you how many PF_RING instances you'd like for Snort/Suricata (IDS engine processes) and Bro and will tell you how to adjust after the fact. As of securityonion-setup - 20120912-0ubuntu0securityonion201, Setup should analyze your system and recommend a certain number of PF_RING instances:
http://blog.securityonion.net/2016/03/securityonion-setup-20120912.html

Tuning

If you want to change the number of PF_RING instances after running Setup, you can do the following.

Snort/Suricata

• Stop sensor processes:

sudo nsm_sensor_ps-stop

• Edit /etc/nsm/$HOSTNAME-$INTERFACE/sensor.conf and change the IDS_LB_PROCS variable to desired number of cores.
• Start sensor processes:

sudo nsm_sensor_ps-start

If running Snort, the script automatically spawns $IDS_LB_PROCS instances of Snort (using PF_RING), barnyard2, and snort_agent.
If running Suricata, the script automatically copies $IDS_LB_PROCS into
suricata.yaml and then Suricata spins up the PF_RING instances itself.

Bro

For Bro, you would do the following:

• Stop bro:
  

  sudo nsm_sensor_ps-stop --only-bro
  
  

• Edit /opt/bro/etc/node.cfg and change the lb_procs variable to the desired number of cores.
  
• Start bro:
  

  sudo nsm_sensor_ps-start --only-bro
  
  

#### Updating #### Please see the [Upgrade](Upgrade) page for notes on updating the PF_RING kernel module.