<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>I am inspecting two span ports. Each has about 15 million packets per minute, mostly HTTP. Bandwidth is about 2 Gbps on each.<div><br></div><div>I've noticed one new message on startup with beta version.</div><div><div>VLAN disabled, setting cluster type to CLUSTER_FLOW_5_TUPLE</div><div><br></div>Not sure if this has any effect.</div><div><br></div><div><br><div><hr id="stopSpelling">Date: Thu, 30 Apr 2015 23:10:09 +0800<br>Subject: Re: [Oisf-users] Suricata 2.1beta3 vs 2.0.7<br>From: modversion@gmail.com<br>To: coolyasha@hotmail.com<br>CC: oisf-users@lists.openinfosecfoundation.org<br><br><div dir="ltr"><div>It seems that 2.0.7 work better than 2.1beta3.</div>What's the bandwidth you protect by suricata ? 10Gbps or 20Gbps ?<div class="ecxgmail_extra"><br><div class="ecxgmail_quote">2015-04-30 23:00 GMT+08:00 Yasha Zislin <span dir="ltr"><<a href="mailto:coolyasha@hotmail.com" target="_blank">coolyasha@hotmail.com</a>></span>:<br><blockquote class="ecxgmail_quote" style="border-left:1px #ccc solid;padding-left:1ex;">
<div><div dir="ltr">I have tweaked my configuration to have Suricata 2.0.7 run with minimal packet loss less than 0.01%. This set up does use a ton of RAM 95% of 140GB.<div>As soon as I switch to Suricata 2.1beta3 and run it with the same config, I get 50% packet loss but RAM utilization stays around 50%.</div><div><br></div><div>What was changed to have such a big impact?</div><div><br></div><div>P.S. I am using PF_RING.</div><div><br></div><div>Thanks.</div> </div></div>
<br>_______________________________________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" target="_blank" rel="noreferrer">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank" rel="noreferrer">http://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank" rel="noreferrer">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
Suricata User Conference November 4 & 5 in Barcelona: <a href="http://oisfevents.net" target="_blank" rel="noreferrer">http://oisfevents.net</a><br></blockquote></div><br></div></div></div></div> </div></body>
</html>