<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="NO-BOK" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US">Hi there. Im testing around with Suricata in VM and there is something i can’t get my head around. I have a server that is well equipped 32GB ram and 8 CPU cores, along with enough harddisk space and so on. There is not
much else running on this machine, and no other CPU/Network/Disk intensive processes either. Traffic I’m receiving is say average around 450Mbit/s. I have turned of offloading on the NIC (checksum, etc), and Don’t see any memcap drops (tcp.ssn_memcap_drop
og tcp.segment_memcap_drop). But what I do see I a lot of packets not buing sent to userspace (as I understand that is what capture.kernel_drops means).<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Kernel: 3.14.5-1.el6.elrepo.x86_64<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">OS: Centos 6.5<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Host info: Running on a VMWare ESXi host.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">(capture.kernel_* in stats.log)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_packets | AFPacketeth11 | 16877739<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_drops | AFPacketeth11 | 249260<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_packets | AFPacketeth12 | 20722043<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_drops | AFPacketeth12 | 11901857<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_packets | AFPacketeth13 | 17474527<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_drops | AFPacketeth13 | 274370<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_packets | AFPacketeth14 | 95842172<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_drops | AFPacketeth14 | 53533152<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_packets | AFPacketeth15 | 20931893<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_drops | AFPacketeth15 | 375185<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_packets | AFPacketeth16 | 14848576<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_drops | AFPacketeth16 | 157094<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_packets | AFPacketeth17 | 14497838<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_drops | AFPacketeth17 | 688556<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_packets | AFPacketeth18 | 15894403<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_drops | AFPacketeth18 | 60119<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_packets | AFPacketeth11 | 16920288<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_drops | AFPacketeth11 | 249260<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_packets | AFPacketeth12 | 20770823<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_drops | AFPacketeth12 | 11901857<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_packets | AFPacketeth13 | 17534417<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_drops | AFPacketeth13 | 274422<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_packets | AFPacketeth14 | 95978498<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_drops | AFPacketeth14 | 53533531<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_packets | AFPacketeth15 | 21016007<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_drops | AFPacketeth15 | 375950<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_packets | AFPacketeth16 | 14923398<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_drops | AFPacketeth16 | 157094<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_packets | AFPacketeth17 | 14559712<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_drops | AFPacketeth17 | 688561<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_packets | AFPacketeth18 | 15942758<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">capture.kernel_drops | AFPacketeth18 | 60119<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Features for eth1:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">rx-checksumming: off<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">tx-checksumming: off<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> tx-checksum-ipv4: off [fixed]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> tx-checksum-ip-generic: off<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> tx-checksum-ipv6: off [fixed]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> tx-checksum-fcoe-crc: off [fixed]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> tx-checksum-sctp: off [fixed]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">scatter-gather: on<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> tx-scatter-gather: on<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> tx-scatter-gather-fraglist: off [fixed]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">tcp-segmentation-offload: off<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> tx-tcp-segmentation: off [requested on]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> tx-tcp-ecn-segmentation: off [fixed]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> tx-tcp6-segmentation: off [requested on]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">udp-fragmentation-offload: off [fixed]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">generic-segmentation-offload: off<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">generic-receive-offload: off<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">large-receive-offload: off<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">rx-vlan-offload: off<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">tx-vlan-offload: off<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">ntuple-filters: off [fixed]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">receive-hashing: on<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">highdma: on<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">rx-vlan-filter: on [fixed]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">vlan-challenged: off [fixed]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">tx-lockless: off [fixed]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">netns-local: off [fixed]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">tx-gso-robust: off [fixed]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">tx-fcoe-segmentation: off [fixed]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">tx-gre-segmentation: off [fixed]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">tx-ipip-segmentation: off [fixed]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">tx-sit-segmentation: off [fixed]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">tx-udp_tnl-segmentation: off [fixed]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">tx-mpls-segmentation: off [fixed]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">fcoe-mtu: off [fixed]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">tx-nocache-copy: off<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">loopback: off [fixed]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">rx-fcs: off [fixed]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">rx-all: off [fixed]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">tx-vlan-stag-hw-insert: off [fixed]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">rx-vlan-stag-hw-parse: off [fixed]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">rx-vlan-stag-filter: off [fixed]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">l2-fwd-offload: off [fixed]<o:p></o:p></span></p>
</div>
</body>
</html>