<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Coop,<div><br></div><div>That makes sense. So you are saying that if there is a DOS attack to one host, only one thread would be utilized for inspection? It wouldnt just spread out across all detection threads?</div><div><br></div><div>Also, I did look at other threads and some have less capture.kernel_packets and some have MORE. These with higher values have no packet loss.</div><div><br></div><div>Here is another twist to the story.</div><div>So these two SPAN ports that I monitor are before and after border firewall. Packet loss occurs only on internal interface. I would think that the firewall has high chance of stopping DOS attack.</div><div><br></div><div>Thanks for the info.<br><br><div>> Date: Mon, 3 Nov 2014 09:48:30 -0800<br>> From: cnelson@ucsd.edu<br>> To: coolyasha@hotmail.com; oisf-users@lists.openinfosecfoundation.org<br>> Subject: Re: [Oisf-users] Occasional burst of packet loss<br>> <br>> -----BEGIN PGP SIGNED MESSAGE-----<br>> Hash: SHA1<br>> <br>> If you are monitoring a big DMZ network (like an ISP), then you will<br>> almost certainly see sporadic packet drops due to DOS events. Suricata<br>> seems to have a hard limit of packets-per-second-per-core and will drop<br>> packets if there is flood to/from a specific host.<br>> <br>> - -Coop<br>> <br>> On 11/3/2014 8:02 AM, Yasha Zislin wrote:<br>> > I have a pretty beefy server monitoring two SPAN ports. A lot of packets<br>> > are flowing in there, mostly HTTP stuff.<br>> > I have 40 logical CPUs (20 per SPAN Port). I am using PF_RING.<br>> > <br>> > I've noticed that I get an occasional packet loss and it's a burst of<br>> > packets. After that it is fine for days.<br>> > So couple of PF Ring instances report packet loss (ie cat<br>> <br>> <br>> - -- <br>> Cooper Nelson<br>> Network Security Analyst<br>> UCSD ACT Security Team<br>> cnelson@ucsd.edu x41042<br>> -----BEGIN PGP SIGNATURE-----<br>> Version: GnuPG v2.0.17 (MingW32)<br>> <br>> iQEcBAEBAgAGBQJUV7/uAAoJEKIFRYQsa8FWA7EIAJCLWbp0kYfMsJyERim/AKnw<br>> c15Csb/lkWqaO4PepibTCegnbYva+lrSf3MGuGGFrfWNZUe8e3fXJOWqicxMrcvV<br>> wdiMOIMFAMU8YPTqCZqJ7lGrY0TP5R0gn+Q5CTIhgdDg1raWDz/SUCZlh9kg3GHN<br>> miWLLaIkWkhgcTznE86XRnz2Omq2IREwFwaQe8/kjC6QW42LqDMXncxw6pSAJ2bJ<br>> yIw3lIadw37FpVtfG0FGi3jv/KzbCLjFIUJyFVwI8KilLSG+/eAfH949yLjEMyvY<br>> 2FwQxLrMJqxaF1S/rHTjAfVt2GRbeAj5BmN990xfX0fOUYZCN6cj10VdHi3YTfM=<br>> =Ty7D<br>> -----END PGP SIGNATURE-----<br></div></div> </div></body>
</html>