Thanks Dave for the explanation. I'll definitively give pf_ring a try. However, now that I'm looking more carefully to the output, I see that the two lines show different results:<br><br>[10424] 5/1/2011 -- 15:21:14 - (source-pcap.c:429) <Info><br>
(ReceivePcapThreadExitStats) -- (ReceivePcap) Packets 24902042, bytes<br>
14643147733<br>
[10424] 5/1/2011 -- 15:21:14 - (source-pcap.c:437) <Info><br>
(ReceivePcapThreadExitStats) -- (ReceivePcap) Pcap Total:117734236<br>
Recv:71318162 Drop:46416074 (39.4%).<br><br>In the first line, the number of received/total(?) packets is 24902042. In the second line the number of packets(?) is completely different: 117734236 total and 71318162 received.<br>
<br>Looking into the code, the first line came from tv (ThreadVars) while the second line came from data (PcapThreadVars). However I don't understand what is the difference between them.<br><br>Thanks,<br><br>David<br>
<br><div class="gmail_quote">On Wed, Jan 5, 2011 at 8:14 PM, Dave Remien <span dir="ltr"><<a href="mailto:dave.remien@gmail.com">dave.remien@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<br><br><div class="gmail_quote">On Wed, Jan 5, 2011 at 10:00 AM, <span dir="ltr"><<a href="mailto:oisf-users-request@openinfosecfoundation.org" target="_blank">oisf-users-request@openinfosecfoundation.org</a>></span> wrote:<br>
<div>
<br></div><div> </div><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"> Date: Wed, 5 Jan 2011 16:13:02 +0100 </blockquote><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
From: David Rodrigues <<a href="mailto:david.network.security@gmail.com" target="_blank">david.network.security@gmail.com</a>><br>
Subject: [Oisf-users] Drop rate<br>
To: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundation.org</a><br>
Message-ID:<br>
<AANLkTinXNtqV435fKCLkwASSg6=yKj2sGfKAz0aN=<a href="mailto:3h7@mail.gmail.com" target="_blank">3h7@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="iso-8859-1"<br>
<br>
Hi all,<br>
<br>
First, I would like to wish a happy new year to all.<br></blockquote><div><br></div><div>Happy New Year to you too! </div><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<br>
I'm having some doubts about snort statistics. I'm testing Suricata in a<br>
very high speed network and I would like to have statistics about<br>
performance (e.g.: drop rate).<br>
<br>
The drop rate I'm using is the one printed when Suricata exists. But this is<br>
the Pcap statistics:<br>
[10424] 5/1/2011 -- 15:21:14 - (source-pcap.c:429) <Info><br>
(ReceivePcapThreadExitStats) -- (ReceivePcap) Packets 24902042, bytes<br>
14643147733<br>
[10424] 5/1/2011 -- 15:21:14 - (source-pcap.c:437) <Info><br>
(ReceivePcapThreadExitStats) -- (ReceivePcap) Pcap Total:117734236<br>
Recv:71318162 Drop:46416074 (39.4%).<br>
<br>
Does it means that it only regards Pcap? For instance, if I have a 39 drop<br>
rate does it means that Suricata analyzed 61% of the traffic? Or does it<br>
means that Pcap captured 61% of the packet and Suricata can still drop more?<br></blockquote><div><br></div><div>Suricata should have printed out how many packets it processed in the stats.log file, for comparison.</div>
<div><br></div><div>Traditionally, especially in high traffic scenarios, the Linux pcap Drop numbers aren't very reliable, in that more (to many more) pkts may have been dropped than pcap reports. Pcapping is a best-case effort; results not guaranteed. Higher speed packet capture options include mem-mapped pcap and pf_ring.</div>
<div> </div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"> Anther question is: can I have drop statistics without shutting down.</blockquote>
<div><br></div><div>The pcap_stats() call could be checked at the stats report interval, and the results reported with the rest of the stats.</div><div> </div><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
Suricata?<br>
<br>
Thanks a lot,<br>
<br>
David<br></blockquote><div><br></div><div>Cheers,</div><div><br></div><div>Dave</div><div> </div><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<br>
End of Oisf-users Digest, Vol 14, Issue 2<br>
*****************************************<br>
</blockquote></div><br clear="all"><br>-- <br>"Of course, someone who knows more about this will correct me if I'm<br>wrong, and someone who knows less will correct me if I'm right." <br>David Palmer (<a href="mailto:palmer@tybalt.caltech.edu" target="_blank">palmer@tybalt.caltech.edu</a>)<br>
<br>
</blockquote></div><br>