Thank you both for the answers. There is an option in suricata.yaml <div>"<span style="color:rgb(72, 72, 72);font-family:monospace;font-size:12px;white-space:pre-wrap">checksum_validation: yes #Validate packet checksum, reject packets with invalid checksums.</span>"<br>
<br></div><div>Are Wrong checksums packets dropped and registered by <span style="font-family:'courier new', monospace;font-size:13px">(ReceivePcapThreadExitStats)or (ReceiveNFQThreadExitStats)? I guess no, because if that's the case, they shouldn't pass through Suricata and that option wouldn't make sense. </span></div>
<div><span style="font-family:'courier new', monospace;font-size:13px"><br></span></div><div><span style="font-family:'courier new', monospace;font-size:13px">Excuse me please if I am going around circles with this question, I am very confused with what dropped packets are exactly registered when Suricata stops, and these are my indicatives to measure how reliable is Suricata in my network. </span></div>
<div><span style="font-family:'courier new', monospace;font-size:13px"><br></span></div><div><span style="font-family:'courier new', monospace;font-size:13px">Regards, </span></div><div><span style="font-family:'courier new', monospace;font-size:13px"><br>
</span></div><div><span style="font-family:'courier new', monospace;font-size:13px">Fernando</span></div>
<div><br><div class="gmail_quote">2011/8/10 Gene Albin <span dir="ltr"><<a href="mailto:gene.albin@gmail.com" target="_blank">gene.albin@gmail.com</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Fernando,<div> I think the difference is where the packets are dropped. (please correct me if I'm wrong). Drops from the memcap counters are because too few memory resources have been assigned to the suricata engine, therefore the memory buffer fills and Suricata drops the packet. On the other hand, the dropped packets reported by <span style="font-family:'courier new', monospace;font-size:13px;background-color:rgb(255, 255, 255)">(ReceivePcapThreadExitStats)</span>are dropped at the pcap level, before it even gets into Suricata. Indicative, I think, of a problem in the OS or the hardware, but not in Suricata.</div>
<div><br></div><div> Any sage advice from those who know what they're talking about?</div><div><br></div><font color="#888888"><div>Gene</div></font><div><div><br><div class="gmail_quote">On Wed, Aug 10, 2011 at 12:36 PM, Will Metcalf <span dir="ltr"><<a href="mailto:william.metcalf@gmail.com" target="_blank">william.metcalf@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>> Will, I have a question. Is the number in dropped packets registered wher<br>
> Suricata stops is independent of the number of packets drops by memcap_drops<br>
> in stats.log?<br>
<br>
</div>Yes<br>
<div><div></div><div><br>
On Wed, Aug 10, 2011 at 2:34 PM, Fernando Ortiz<br>
<<a href="mailto:fernando.ortiz.f@gmail.com" target="_blank">fernando.ortiz.f@gmail.com</a>> wrote:<br>
> Will, I have a question. Is the number in dropped packets registered wher<br>
> Suricata stops is independent of the number of packets drops by memcap_drops<br>
> in stats.log?<br>
><br>
> Cheers,<br>
> Fernando<br>
><br></div></div></blockquote></div><br clear="all"><br></div>-- <br><div>Gene Albin<br><a href="mailto:gene.albin@gmail.com" target="_blank">gene.albin@gmail.com</a><br><br>
</div></div>
</blockquote></div><br><br clear="all"><br>-- <br>Fernando Ortiz <br>Twitter: <a href="http://twitter.com/FernandOrtizF" target="_blank">http://twitter.com/FernandOrtizF</a><br> <br>
</div>