<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>I am using latest release of Suricata (2.0.6) to monitor two span ports on one server. I am using PF_RING with 20 detection threads for each SPAN port. <div>I have finally tweaked my various memory buffers in suricata config to eliminate packet loss almost to zero. </div><div><br></div><div>Recently I've noticed some strange info from running ifconfig. Both of my span ports report errors like theses:</div><div><div>RX packets:561843496193 errors:3438084 dropped:0 overruns:3438082 frame:2</div></div><div><br></div><div>Not sure what the errors and overruns mean and how can I improve that?</div><div><br></div><div>The only thing I can think of is this:</div><div><div> ethtool -C eth0 rx-usecs 500</div></div><div><br></div><div>That's what I am using. I was using a value of 1000 and changing to 500 seemed to make it better with packet loss. But setting it to 1 makes it worse.</div><div><br></div><div>Ideas?</div><div><br></div><div>Thank you.</div> </div></body>
</html>