Zeek Capture Loss

[cvfdblaze624]

I have a fresh install of SO on top of Ubuntu using the guide posted. I was having issues with Zeek having no packet loss but capture loss from 30-100%. After trying multiple fixes I found I discovered the issue was with off-loading on my NIC. I wrote the below ethtool script to run at boot and it seems to have fixed my issue, now 0% loss both packets and capture. I wanted to share in case anyone else was having a similar problem. Thanks for the great product!!

ethtool -K <sniffing_interface> rx off tx off sg off tso off gso off gro off

[weslambert]

What version of SO is this, and did you manually add the NIC to the bond0 configuration, or was it configured during setup?

[cvfdblaze624]

I just upgraded to the newest 2.30 version, the NIC was added during the install so I didn't have to do anything to change that