<br><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">
<br>
</div></div>That's made a huge difference! I'd just resorted to using PF_RING via<br>
libpcap (where the BPF filters may work) which seemed to be doing a bit<br>
better. Putting in your patch and going back to direct PF_RING is<br>
dropping almost no packets at 1.2Gb/s.<br>
<div class="im HOEnZb"><br></div></blockquote><div>Chris  - what is your HW set up, if you don't mind me asking?<br> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im HOEnZb">
Best Wishes,<br>
Chris<br>
<br>
--<br>
--+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+-<br>
Christopher Wakelin,                           <a href="mailto:c.d.wakelin@reading.ac.uk">c.d.wakelin@reading.ac.uk</a><br>
</div><div class="im HOEnZb">IT Services Centre, The University of Reading,  Tel: <a href="tel:%2B44%20%280%29118%20378%202908" value="+441183782908">+44 (0)118 378 2908</a><br>
</div><div class="im HOEnZb">Whiteknights, Reading, RG6 6AF, UK              Fax: <a href="tel:%2B44%20%280%29118%20975%203094" value="+441189753094">+44 (0)118 975 3094</a><br>
</div><div class="HOEnZb"><div class="h5">_______________________________________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
OISF: <a href="http://www.openinfosecfoundation.org/" target="_blank">http://www.openinfosecfoundation.org/</a><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br><div>Regards,</div>
<div>Peter Manev</div>