<div>I once asked something similar:</div><a href="http://lists.openinfosecfoundation.org/pipermail/oisf-users/2011-June/000658.html">http://lists.openinfosecfoundation.org/pipermail/oisf-users/2011-June/000658.html</a><div>
<br></div><div>Just for curiosity. What is your maximum consumption of RAM while running suricata? </div><div><br><br><div class="gmail_quote">2011/8/1 Gene Albin <span dir="ltr"><<a href="mailto:gene.albin@gmail.com" target="_blank">gene.albin@gmail.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
So it looks like increasing the stream and flow memcap variables to 1 and 2 GB seems to have fixed the segment_memcap_drop numbers:<div><br></div><div><div><font face="'courier new', monospace">tcp.sessions | Decode & Stream | 62179</font></div>
<div>
<div><font face="'courier new', monospace">tcp.ssn_memcap_drop | Decode & Stream | 0</font></div></div><div><font face="'courier new', monospace">tcp.pseudo | Decode & Stream | 10873</font></div>
<div><font face="'courier new', monospace">tcp.segment_memcap_drop | Decode & Stream | 0</font></div><div><font face="'courier new', monospace">tcp.stream_depth_reached | Decode & Stream | 347</font></div>
<div><font face="'courier new', monospace">detect.alert | Detect | 715</font></div></div><div><br></div><div>But according to (ReceivePcapThreadExitStats) I'm still losing about 20% of my packets. Any ideas on why this may be? Below is a cut from the suricata.log file showing the packet drops after I increased the memcap values.</div>
<div><br></div><div><div><font face="'courier new', monospace">Increased Flow memcap from 32MB to 1GB</font></div><div><font face="'courier new', monospace">No change:</font></div>
<div><font face="'courier new', monospace"><br></font></div><div><font face="'courier new', monospace">[11736] 1/8/2011 -- 13:27:07 - (source-pcap.c:561) <Info> (ReceivePcapThreadExitStats) -- (ReceivePcap) Packets 1784959, bytes 1318154313</font></div>
<div><font face="'courier new', monospace">[11736] 1/8/2011 -- 13:27:07 - (source-pcap.c:569) <Info> (ReceivePcapThreadExitStats) -- (ReceivePcap) Pcap Total:3865595 Recv:2825319 Drop:1040276 (26.9%).</font></div>
<div><font face="'courier new', monospace"><br></font></div><div><font face="'courier new', monospace">Increased Stream memcap from 32MB to 1GB</font></div>
<div><font face="'courier new', monospace">Increased Stream reassembly memcap from 64MB to 2GB</font></div><div><font face="'courier new', monospace">No change:</font></div>
<div><font face="'courier new', monospace"><br></font></div><div><font face="'courier new', monospace">[11955] 1/8/2011 -- 13:34:38 - (source-pcap.c:561) <Info> (ReceivePcapThreadExitStats) -- (ReceivePcap) Packets 2906643, bytes 1977212962</font></div>
<div><font face="'courier new', monospace">[11955] 1/8/2011 -- 13:34:38 - (source-pcap.c:569) <Info> (ReceivePcapThreadExitStats) -- (ReceivePcap) Pcap Total:5634300 Recv:4270513 Drop:1363787 (24.2%).</font></div>
<div><br></div><font color="#888888"><div>Gene</div></font><div><div></div><div><div><br></div><br><div class="gmail_quote">On Fri, Jul 29, 2011 at 8:17 PM, Gene Albin <span dir="ltr"><<a href="mailto:gene.albin@gmail.com" target="_blank">gene.albin@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">What causes the tcp.segment_memcap_drop and the tcp.ssn_memcap_drop counters to increment in the stats.log file? I haven't found much of a description or suggestions on what I can do to reduce the number. Here is a cut from my stats.log file:<br>
<br><span style="font-family:courier new,monospace">tcp.sessions | Decode & Stream | 569818</span><br style="font-family:courier new,monospace"><span style="font-family:courier new,monospace">tcp.ssn_memcap_drop | Decode & Stream | 0</span><br style="font-family:courier new,monospace">
<span style="font-family:courier new,monospace">tcp.pseudo | Decode & Stream | 94588</span><br style="font-family:courier new,monospace"><span style="font-family:courier new,monospace">tcp.segment_memcap_drop | Decode & Stream | 11204200</span><br style="font-family:courier new,monospace">
<span style="font-family:courier new,monospace">tcp.stream_depth_reached | Decode & Stream | 14</span><br style="font-family:courier new,monospace"><span style="font-family:courier new,monospace">detect.alert | Detect | 13239</span><br style="font-family:courier new,monospace">
<br>Thanks for any suggestions.<br><br>Gene<br><font color="#888888"><br>-- <br>Gene Albin<br><a href="mailto:gene.albin@gmail.com" target="_blank">gene.albin@gmail.com</a><br><br>
</font></blockquote></div><br><br clear="all"><br>-- <br>Gene Albin<br><a href="mailto:gene.albin@gmail.com" target="_blank">gene.albin@gmail.com</a><br><br>
</div></div></div>
<br>_______________________________________________<br>
Oisf-users mailing list<br>
<a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a><br>
<a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
<br></blockquote></div><br><br clear="all"><br>
</div>