<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>That percentage doesnt match what Suricata reports on packet loss. At the same time it is also very small which is ok.<div>The problem I've noticed is that after some time I had suricata partially freeze and have small detection rate. I've noticed this after upgrading to 2.0.6. When I tried to restart it, it failed to start with error "failed to initialize" one of PF RING interfaces. After I killed it manually, it is working. Just trying to be proactive.</div><div><br></div><div>If you these errors on interface cannot cause anything like that, then something else is.<br><br><div>> Date: Mon, 23 Feb 2015 23:13:50 +0100<br>> From: petermanev@gmail.com<br>> To: coolyasha@hotmail.com; oisf-users@lists.openinfosecfoundation.org<br>> Subject: Re: [Oisf-users] Packets errors<br>> <br>> <br>> <br>> On 02/23/2015 02:54 PM, Yasha Zislin wrote:<br>> > I am using latest release of Suricata (2.0.6) to monitor two span ports on one server. I am using PF_RING with 20 detection threads for each SPAN port. I have finally tweaked my various memory buffers in suricata config to eliminate packet loss almost to zero. <br>> > Recently I've noticed some strange info from running ifconfig. Both of my span ports report errors like theses:RX packets:561843496193 errors:3438084 dropped:0 overruns:3438082 frame:2<br>> <br>> From the info provided - errors are 0.00061% of packets - is it really<br>> that critical in your case?<br>> <br>> <br>> > Not sure what the errors and overruns mean and how can I improve that?<br>> <br>> http://www.tldp.org/LDP/nag2/x-087-2-iface.ifconfig.html<br>> <br>> > The only thing I can think of is this: ethtool -C eth0 rx-usecs 500<br>> > That's what I am using. I was using a value of 1000 and changing to 500 seemed to make it better with packet loss. But setting it to 1 makes it worse.<br>> > Ideas?<br>> > Thank you. <br>> > <br>> > <br>> > <br>> > _______________________________________________<br>> > Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>> > Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>> > List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br>> > Training now available: http://suricata-ids.org/training/<br>> > <br>> <br>> -- <br>> <br>> Regards,<br>> Peter Manev<br></div></div> </div></body>
</html>