<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>How do you increase socket buffers?<div><br></div><div>I've increased a lot of buffers already. That's why my memory utilization is high.</div><div>I've also maxed out NIC buffers and PF_RING ring size.</div><div><br></div><div>Thanks.<br><br><div>> Date: Tue, 4 Nov 2014 08:11:36 -0800<br>> From: cnelson@ucsd.edu<br>> To: coolyasha@hotmail.com; oisf-users@lists.openinfosecfoundation.org<br>> Subject: Re: [Oisf-users] Occasional burst of packet loss<br>> <br>> -----BEGIN PGP SIGNED MESSAGE-----<br>> Hash: SHA1<br>> <br>> Not sure if this works the same as with PF_RING, but I've found<br>> increasing the socket buffers can help with packet drops during DOS<br>> attacks when running in AF_PACKET mode. eg:<br>> <br>> > buffer-size: 1048576<br>> <br>> On 11/3/2014 11:35 AM, Yasha Zislin wrote:<br>> > <br>> > I guess, I am trying to figure out if there is a way to reduce packet<br>> > loss and improve performance while being attacked by either DDOS or<br>> > something else.<br>> > <br>> > Thanks.<br>> > <br>> <br>> - -- <br>> Cooper Nelson<br>> Network Security Analyst<br>> UCSD ACT Security Team<br>> cnelson@ucsd.edu x41042<br>> -----BEGIN PGP SIGNATURE-----<br>> Version: GnuPG v2.0.17 (MingW32)<br>> <br>> iQEcBAEBAgAGBQJUWPq4AAoJEKIFRYQsa8FWVu0IAMr8JKausfNOpGwachndvXn7<br>> 5GKrmgWi/LJ2jNIWc5UVpC5a/JfxfS4WR2crzWbTpaSqjiIGwskhmfsFEg9zaUfq<br>> d9npoo8W6hL7EW/18f+29zajtwoCry58W1ZqLHFPBBEfOoGV0f4NQOCEi6tudf6M<br>> CEFIkyhEMeXhNzg++bm22TUjhEHesa1S92tStS0zniYJrRhyGTX6B/kXEzedEk/l<br>> Adx5yzgJrWAsSFgxTR6I1JjsOaBwQvUqsE7uYlEQb9JVOpwK0DGQitXQfUmQ+vWx<br>> nFMkxHAkqIgOJq4WXn1SGnUEZ9hsojZIMh+C1kUc6HUPdOCUlJKVCKQYyDoX4js=<br>> =9Bcm<br>> -----END PGP SIGNATURE-----<br></div></div> </div></body>
</html>