<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>I am running Suricata 2.1beta4 with PF_RING.<div>I have 4 threads (4 logical CPUs) monitoring one interface. After a few minutes of running, I get 50% packet loss.</div><div>I have tweaked all of the stream reassembly buffers to avoid packet loss. Only one of the threads gets kernel packet drops. I've noticed that one CPU is running at 100% and others are almost idle. Looking at stats.log, that one thread for some reason is digesting more packets than others.</div><div>Throughput on this sensor is not that big. About 500k packets a minute. I use this image on other sensors without issues. </div><div><br></div><div>Need help to figure out why only one thread is doing MOST of the work.</div><div><br></div><div>Thank you.</div> </div></body>
</html>