<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<p dir="ltr">Are you sure it is not supported? You can try compiling pfring with vmware
<u>nics</u><br>
</p>
<br>
<br>
<br>
<div class="gmail_quote">On Sun, Nov 1, 2015 at 6:46 AM -0800, "Brian Hennigar" <span dir="ltr">
<<a href="mailto:bhennigar@gmail.com" target="_blank">bhennigar@gmail.com</a>></span> wrote:<br>
<br>
</div>
<div>
<p dir="ltr">Im running things in a vm and unfortunately pfring isn't supported on the 10gb vmxnet3 Interfaces.
</p>
<p dir="ltr">Is there a recommended threads:cores ratio? <br>
</p>
<div class="x_gmail_quote">On Nov 1, 2015 10:41 AM, <<a href="mailto:coolyasha@hotmail.com">coolyasha@hotmail.com</a>> wrote:<br type="attribution">
<blockquote class="x_gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div>
<p dir="ltr">I've done pfring in auto mode for two 10 gig interfaces. 40 threads total. Using 70 gig of ram to preserve streams. Almost 0 packet
<u>loss</u><br>
</p>
<br>
<br>
<br>
<div class="x_gmail_quote">On Sun, Nov 1, 2015 at 6:32 AM -0800, "Peter Manev" <span dir="ltr">
<<a href="mailto:petermanev@gmail.com" target="_blank">petermanev@gmail.com</a>></span> wrote:<br>
<br>
</div>
<div>
<div>On Wed, Oct 28, 2015 at 6:19 PM, Brian Hennigar <<a href="mailto:bhennigar@gmail.com" target="_blank">bhennigar@gmail.com</a>> wrote:<br>
> Hi,<br>
> I'm looking for recommendations for using suricata un runmode: workers and<br>
> AF_Packet with multiple capture interfaces. I'm not how to best configure<br>
> the threads and cluster-id.<br>
> I have 3 relatively low traffic span interfaces (IDS mode, alert only) and 6<br>
> cores.<br>
><br>
> Would each interface need to have it's own cluster-id? Would the best<br>
> threads setting be auto for each interface?<br>
<br>
You would need a diff cluster-id , yes.<br>
If you dont have much traffic auto is fine otherwise you need to go to<br>
manual configuration of the number of threads per interface and<br>
budget more threads for more traffic.<br>
<br>
><br>
> Thanks!<br>
> Brian<br>
><br>
> _______________________________________________<br>
> Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">
oisf-users@openinfosecfoundation.org</a><br>
> Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support:
<a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br>
> List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">
https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
> Suricata User Conference November 4 & 5 in Barcelona: <a href="http://oisfevents.net" target="_blank">
http://oisfevents.net</a><br>
<br>
<br>
<br>
-- <br>
Regards,<br>
Peter Manev<br>
_______________________________________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">
oisf-users@openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support:
<a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">
https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
Suricata User Conference November 4 & 5 in Barcelona: <a href="http://oisfevents.net" target="_blank">
http://oisfevents.net</a><br>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</body>
</html>