Since anmuscle scheduled release version 4.9.1-1, device identification has improved for completeness, accuracy and de-duplication. The muscle is capable of peeking at ethernet frames in a zero-copy manner making packet monitoring much more CPU efficient by making use of this System Tunable option in pfSense:
| Property | Value |
|---|---|
| System Tunable | net.bpf.zerocopy_enable |
| Value | 1 |
| Description | Enable new zero-copy BPF buffer sessions |
Note that this setting is automatically set with adamone-setup configure. However, if your installation took place prior to 4.9.1-1 and set for auto-upgrade, it will not be automatically set even with cron upgrading your muscle version.
In that case, the tunable will not be set, but it can be applied manually in the GUI as follows.
From the System Menu → Advanced → System Tunables → New (copy & paste from above) and when complete, it will show like this:
A system reboot is required for the change to take effect.
This will likely be a recommendation coming from our support team if anmuscle uses excessive CPU resources in your implementation.