<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<p dir="ltr">I've done pfring in auto mode for two 10 gig interfaces. 40 threads total. Using 70 gig of ram to preserve streams. Almost 0 packet
<u>loss</u><br>
</p>
<br>
<br>
<br>
<div class="gmail_quote">On Sun, Nov 1, 2015 at 6:32 AM -0800, "Peter Manev" <span dir="ltr">
<<a href="mailto:petermanev@gmail.com" target="_blank">petermanev@gmail.com</a>></span> wrote:<br>
<br>
</div>
<div class="BodyFragment">
<div class="PlainText">On Wed, Oct 28, 2015 at 6:19 PM, Brian Hennigar <bhennigar@gmail.com> wrote:<br>
> Hi,<br>
> I'm looking for recommendations for using suricata un runmode: workers and<br>
> AF_Packet with multiple capture interfaces. I'm not how to best configure<br>
> the threads and cluster-id.<br>
> I have 3 relatively low traffic span interfaces (IDS mode, alert only) and 6<br>
> cores.<br>
><br>
> Would each interface need to have it's own cluster-id? Would the best<br>
> threads setting be auto for each interface?<br>
<br>
You would need a diff cluster-id , yes.<br>
If you dont have much traffic auto is fine otherwise you need to go to<br>
manual configuration of the number of threads per interface and<br>
budget more threads for more traffic.<br>
<br>
><br>
> Thanks!<br>
> Brian<br>
><br>
> _______________________________________________<br>
> Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>
> Site: <a href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/">
http://suricata-ids.org/support/</a><br>
> List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">
https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
> Suricata User Conference November 4 & 5 in Barcelona: <a href="http://oisfevents.net">
http://oisfevents.net</a><br>
<br>
<br>
<br>
-- <br>
Regards,<br>
Peter Manev<br>
_______________________________________________<br>
Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>
Site: <a href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/">
http://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">
https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
Suricata User Conference November 4 & 5 in Barcelona: <a href="http://oisfevents.net">
http://oisfevents.net</a><br>
</div>
</div>
</body>
</html>