<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>I am trying to narrow down good config to reduce packet loss. It seems that it is related to reassembly of streams.<div>I keep getting reassembly gaps and therefore packet loss. Here is an example stats.log</div><div><div>capture.kernel_packets | RxPFReth02 | 455937792</div><div>capture.kernel_drops | RxPFReth02 | 2921250</div><div>dns.memuse | RxPFReth02 | 248</div><div>dns.memcap_state | RxPFReth02 | 0</div><div>dns.memcap_global | RxPFReth02 | 0</div><div>decoder.pkts | RxPFReth02 | 455937797</div><div>decoder.bytes | RxPFReth02 | 251634185655</div><div>decoder.invalid | RxPFReth02 | 0</div><div>decoder.ipv4 | RxPFReth02 | 455937797</div><div>decoder.ipv6 | RxPFReth02 | 0</div><div>decoder.ethernet | RxPFReth02 | 455937797</div><div>decoder.raw | RxPFReth02 | 0</div><div>decoder.null | RxPFReth02 | 0</div><div>decoder.sll | RxPFReth02 | 0</div><div>decoder.tcp | RxPFReth02 | 441994599</div><div>decoder.udp | RxPFReth02 | 2105539</div><div>decoder.sctp | RxPFReth02 | 0</div><div>decoder.icmpv4 | RxPFReth02 | 11834719</div><div>decoder.icmpv6 | RxPFReth02 | 0</div><div>decoder.ppp | RxPFReth02 | 0</div><div>decoder.pppoe | RxPFReth02 | 0</div><div>decoder.gre | RxPFReth02 | 0</div><div>decoder.vlan | RxPFReth02 | 0</div><div>decoder.vlan_qinq | RxPFReth02 | 0</div><div>decoder.teredo | RxPFReth02 | 0</div><div>decoder.ipv4_in_ipv6 | RxPFReth02 | 0</div><div>decoder.ipv6_in_ipv6 | RxPFReth02 | 0</div><div>decoder.mpls | RxPFReth02 | 0</div><div>decoder.avg_pkt_size | RxPFReth02 | 551</div><div>decoder.max_pkt_size | RxPFReth02 | 1510</div><div>defrag.ipv4.fragments | RxPFReth02 | 0</div><div>defrag.ipv4.reassembled | RxPFReth02 | 0</div><div>defrag.ipv4.timeouts | RxPFReth02 | 0</div><div>defrag.ipv6.fragments | RxPFReth02 | 0</div><div>defrag.ipv6.reassembled | RxPFReth02 | 0</div><div>defrag.ipv6.timeouts | RxPFReth02 | 0</div><div>defrag.max_frag_hits | RxPFReth02 | 0</div><div>tcp.sessions | RxPFReth02 | 2006412</div><div>tcp.ssn_memcap_drop | RxPFReth02 | 0</div><div>tcp.pseudo | RxPFReth02 | 967397</div><div>tcp.pseudo_failed | RxPFReth02 | 0</div><div>tcp.invalid_checksum | RxPFReth02 | 0</div><div>tcp.no_flow | RxPFReth02 | 0</div><div>tcp.memuse | RxPFReth02 | 115872960</div><div>tcp.syn | RxPFReth02 | 2110195</div><div>tcp.synack | RxPFReth02 | 1939793</div><div>tcp.rst | RxPFReth02 | 601837</div><div>tcp.segment_memcap_drop | RxPFReth02 | 0</div><div>tcp.stream_depth_reached | RxPFReth02 | 12791</div><div>tcp.reassembly_memuse | RxPFReth02 | 895804872</div><div>tcp.reassembly_gap | RxPFReth02 | 27248</div><div>http.memuse | RxPFReth02 | 12684863</div><div>http.memcap | RxPFReth02 | 0</div><div>detect.alert | RxPFReth02 | 30913</div></div><div><br></div><div>I keep increasing memcaps in stream, reassembly, prealloc session numbers. Segments in reassembly have been tweaked already.</div><div><br></div><div>It feels like I am just guessing with memcaps. Is there a better way to know which buffer setting I need to increase?</div><div><br></div><div>Thank you.</div> </div></body>
</html>