<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Good questions. Yes, I have compiled with '--enable-profiling' as well as without. stats.log and packet_stats.log are both enabled in the suricata.yaml file. These two files give me a good breakdown of the number and type of packets which have been processed, but I have not found any information about performance or packets per second.<div>Just for background: I am trying to optimize packet processing through the GPU. To test, I am pushing a large packet capture through the system. I can derive a rough estimate of packets per second but it would be easier if there were an internal statistic which gave me Suricata's opinion.</div><div>Thanks.<br><br><div><hr id="stopSpelling">From: cdevoe57@nycap.rr.com<br>To: akajui@hotmail.com; discussion@lists.openinfosecfoundation.org<br>Subject: RE: [Discussion] Suricata Packets Per Second metric<br>Date: Mon, 23 Dec 2013 20:10:38 -0500<br><br><style><!--
.ExternalClass p.ecxMsoNormal, .ExternalClass li.ecxMsoNormal, .ExternalClass div.ecxMsoNormal {
font-size:12.0pt;
font-family:"Times New Roman","serif";
}
.ExternalClass a:link, .ExternalClass span.ecxMsoHyperlink {
color:blue;
text-decoration:underline;
}
.ExternalClass span.ecxMsoHyperlinkFollowed {
color:purple;
text-decoration:underline;
}
.ExternalClass p {
font-size:12.0pt;
font-family:"Times New Roman","serif";
}
.ExternalClass pre {
font-size:10.0pt;
font-family:"Courier New";
}
.ExternalClass span.ecxEmailStyle18 {
font-family:"Calibri","sans-serif";
color:#1F497D;
}
.ExternalClass span.ecxHTMLPreformattedChar {
font-family:"Courier New";
}
.ExternalClass .ecxMsoChpDefault {
font-size:10.0pt;
}
.ExternalClass div.ecxWordSection1 {
}
--></style><div class="ecxWordSection1"><p class="ecxMsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;">Did you enable the stats file in the suricata.yaml?</span></p><p class="ecxMsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;"> </span></p><div style="border:solid #E2E2E2 1.0pt;padding:6.0pt 6.0pt 6.0pt 6.0pt;background:#FAFAFA;"><pre style="background:#FAFAFA;border:none;padding:0in;"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;">Also when you build suricata use this flag </span><span style="font-size:9.0pt;color:#484848;">--enable-profiling (I think this is the one I used)</span></pre><pre style="background:#FAFAFA;border:none;padding:0in;"><span style="font-size:9.0pt;color:#484848;"> </span></pre></div><p class="ecxMsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;"> </span></p><p class="ecxMsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;"> </span></p><div><div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in;"><p class="ecxMsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";"> discussion-bounces@lists.openinfosecfoundation.org [mailto:discussion-bounces@lists.openinfosecfoundation.org] <b>On Behalf Of </b>Dan Groen<br><b>Sent:</b> Monday, December 23, 2013 12:44 PM<br><b>To:</b> Discussion@lists.openinfosecfoundation.org<br><b>Subject:</b> Re: [Discussion] Suricata Packets Per Second metric</span></p></div></div><p class="ecxMsoNormal"> </p><div><p class="ecxMsoNormal"><span style="font-family:"Calibri","sans-serif";"> </span></p><div><p class="ecxMsoNormal"><span style="font-family:"Calibri","sans-serif";"> </span></p><div><p class="ecxMsoNormal"><span style="font-family:"Calibri","sans-serif";">I am interested in looking at the number of packets per second that Suricata has processed but have not found this metric listed in its output. I have checked the log files, alert files, etc.</span></p><div><p class="ecxMsoNormal"><span style="font-family:"Calibri","sans-serif";"> </span></p></div><div><p class="ecxMsoNormal"><span style="font-family:"Calibri","sans-serif";">There are multiple papers online which list pps or packets/second, so my suspicion is that i am missing something obvious. Could someone direct me to the appropriate data set?</span></p></div><div><p class="ecxMsoNormal"><span style="font-family:"Calibri","sans-serif";"> </span></p></div><div><p class="ecxMsoNormal"><span style="font-family:"Calibri","sans-serif";">Thanks.</span></p></div></div></div></div></div></div></div> </div></body>
</html>