[Oisf-users] Causes for Dropped Packets

[Charles DeVoe]

I have several sensors monitoring large bandwidth pipes (1G < bandwidth < 10G),  These sensors have in excess of 40 cores 64 GB of memory.  Monitoring activity with htop I see that the processors are hardly working and memory is less than 50% used.  Yet I still see capture.kernel_drops.  I am wondering what exactly are the reasons that I get these.  I have looked at the paper written by Michal Purzynski and Peter Manev "Suricata Extreme Performance Tuning"  (Great paper guys, Thanks)  and see in the end they still have 0.00137% drops, what are causing those???
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20170129/e55208d1/attachment.html>