<div dir="ltr">Hi Michael,<div><br></div><div>Thank you very much for your suggestions. I have tuned these options. But no luck :)</div><div><br></div><div>After that, I wrote a short code that reads from divert socket and write back.</div>
<div><br></div><div><div>while( 1 ) { </div><div><span class="" style="white-space:pre"> </span>origBytes = recvfrom( sock, buf, sizeof buf, 0, (struct sockaddr *)&addr, &addrSize );</div><div><span class="" style="white-space:pre"> </span>wroteBytes = sendto( sock, buf, origBytes, 0, (struct sockaddr*) &addr, sizeof addr );</div>
<div>}</div></div><div><br></div><div>I wondered that if this test code bumps the netisr to %100 ?</div><div>I was diverted all the traffic to this test code. with this test netisr uses only %1 or %2 cpu for 400Mbps.</div>
<div><br></div><div>Suricata bumps the netisr usage to %100 even with empty ruleset.</div><div>There is something wrong in suricata 2.0 release.</div><div><br></div><div>And I wanna give some information about nic stopping:</div>
<div>When I remove the divert rule while netisr is at %100 usage, netisr still uses cpu at %100 for a long time.</div><div>While netisr using %100 cpu, most of network functionalities doest work. </div><div>I was monitored queue drops by netstat -Q. Queue drops was increasing even ipfw has no divert rule. ( I think received packets by suricata still processing... )</div>
<div>After about half an hour every thing becomes fine.</div><div><br></div><div>I'll test 1.4.7 and share results with you.</div><div><br></div><div>Best regards</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">
On Fri, Apr 4, 2014 at 7:13 PM, Shirkdog <span dir="ltr"><<a href="mailto:shirkdog@gmail.com" target="_blank">shirkdog@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Even better information from Calomel with some testing to perform to<br>
adjust values accordingly:<br>
<br>
<a href="https://calomel.org/freebsd_network_tuning.html" target="_blank">https://calomel.org/freebsd_network_tuning.html</a><br>
<br>
---<br>
Michael Shirk<br>
<div class="HOEnZb"><div class="h5"><br>
<br>
On Fri, Apr 4, 2014 at 10:48 AM, Shirkdog <<a href="mailto:shirkdog@gmail.com">shirkdog@gmail.com</a>> wrote:<br>
> To look to FreeBSD, you would need to provide additional information.<br>
> If there is nothing dumping, kernel dumps, dmesg output, it may be<br>
> something specific to Suricata.<br>
><br>
> Some things from FreeBSD Wiki on Net tuning and Netisr<br>
><br>
> <a href="https://wiki.freebsd.org/NetworkPerformanceTuning" target="_blank">https://wiki.freebsd.org/NetworkPerformanceTuning</a><br>
><br>
> Netisr<br>
> Bump net.route.netisr_maxqlen to 2048 or higher value.<br>
> This can affect you iff you're doing shaping.<br>
> Do NOT use netisr policy other than 'direct' if you can.<br>
> Current netisr implementation can't split traffic into different ISR<br>
> queues (patches are coming, 2012-02-23).<br>
> Every queue is covered by mutex which is much worse than using<br>
> buf_ring(9) api (patches are coming, 2012-02-23).<br>
><br>
> Performance loss of 10-30% was observed on various scenarios (direct<br>
> dispatch vs deferred of hybrid).<br>
><br>
><br>
><br>
> ---<br>
> Michael Shirk<br>
><br>
><br>
> On Fri, Apr 4, 2014 at 8:47 AM, Özkan KIRIK <<a href="mailto:ozkan.kirik@gmail.com">ozkan.kirik@gmail.com</a>> wrote:<br>
>> Hi,<br>
>><br>
>> I am trying to use suricata on FreeBSD 10 amd64.<br>
>> FreeBSD behaves as a VLAN router and NAT Box.<br>
>><br>
>> Traffic is about 400Mbps.<br>
>> When i diverted traffic to suricata, ( add 100 divert 8000 all from any to<br>
>> any via em0 )<br>
>> swi: netisr 0 thread gets %100 cpu.<br>
>> other netisr threads are %0. And Even I remove the divert rule, netisr still<br>
>> eats %100 cpu. I think that something looping :)<br>
>> And after 1-2 minutes, one of igb0 and igb1 stops working.<br>
>> Only reboot solves problem.<br>
>><br>
>> Hardware has 8 cores, 24GB Ram<br>
>><br>
>> My loader.conf :<br>
>><br>
>> hw.igb.txd="4096"<br>
>> hw.igb.rxd="4096"<br>
>> hw.igb.rx_process_limit=1024<br>
>> hw.igb.num_queues=3<br>
>> net.isr.maxthreads=3<br>
>> net.isr.bindthreads=1<br>
>> net.isr.defaultqlimit=4096<br>
>> net.isr.maxqlimit=20480<br>
>> net.link.ifqmaxlen=10240<br>
>><br>
>> How can I debug this situation?<br>
>> Any suggestions?<br>
>><br>
>> Best regards<br>
>><br>
>> _______________________________________________<br>
>> Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a><br>
>> Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br>
>> List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
>> OISF: <a href="http://www.openinfosecfoundation.org/" target="_blank">http://www.openinfosecfoundation.org/</a><br>
</div></div></blockquote></div><br></div>