<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Franklin Gothic Book";
panose-1:2 11 5 3 2 1 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>Are you able to characterize the traffic seen by this sensor? With a static load balancing scheme like cluster_flow, which I believe uses something like a hash of the TCP-quad to determine which thread processes a flow, it’s certainly possible for a single thread to get a disproportionate amount of traffic and become bogged down. I’ve seen it before, though not quite as dramatic as in your case, since your other threads appear nearly idle. <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>While the workers runmode is generally accepted as the best practice, you might play around with autofp or different cluster modes just to see if you observe any different behavior. You may not want to make these your permanent settings, but it may help you narrow down your issue.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><div><p class=MsoNormal><b><span style='font-family:"Franklin Gothic Book",sans-serif;color:#1F497D'>________________________<o:p></o:p></span></b></p><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Franklin Gothic Book",sans-serif;color:#1F497D'>Zach Rasmor<o:p></o:p></span></b></p><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Franklin Gothic Book",sans-serif;color:#1F497D'>Email: <a href="mailto:zachary.r.rasmor@lmco.com"><span style='color:blue'>zachary.r.rasmor@lmco.com</span></a></span><b><span style='font-size:10.0pt;font-family:"Franklin Gothic Book",sans-serif;color:#1F497D'><o:p></o:p></span></b></p><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Franklin Gothic Book",sans-serif;color:#1F497D'>Office: 301.240.6116<o:p></o:p></span></p></div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>From:</span></b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'> Oisf-users [mailto:oisf-users-bounces@lists.openinfosecfoundation.org] <b>On Behalf Of </b>Yasha Zislin<br><b>Sent:</b> Thursday, December 24, 2015 7:09 AM<br><b>To:</b> Peter Manev<br><b>Cc:</b> oisf-users@lists.openinfosecfoundation.org<br><b>Subject:</b> EXTERNAL: Re: [Oisf-users] unusual packet loss<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal style='margin-bottom:12.0pt'><span style='font-family:"Calibri",sans-serif'>I have 4 threads running to monitor one interface. One of the threads is consuming 100% CPU and starts to have packet loss. Other 3 have zero packet loss.<o:p></o:p></span></p><div><p class=MsoNormal><span style='font-family:"Calibri",sans-serif'>> Date: Wed, 23 Dec 2015 22:36:44 +0100<br>> Subject: Re: [Oisf-users] unusual packet loss<br>> From: <a href="mailto:petermanev@gmail.com">petermanev@gmail.com</a><br>> To: <a href="mailto:coolyasha@hotmail.com">coolyasha@hotmail.com</a><br>> CC: <a href="mailto:oisf-users@lists.openinfosecfoundation.org">oisf-users@lists.openinfosecfoundation.org</a><br>> <br>> On Wed, Dec 23, 2015 at 3:36 PM, Yasha Zislin <<a href="mailto:coolyasha@hotmail.com">coolyasha@hotmail.com</a>> wrote:<br>> > I am running Suricata 2.1beta4 with PF_RING.<br>> > I have 4 threads (4 logical CPUs) monitoring one interface. After a few<br>> > minutes of running, I get 50% packet loss.<br>> > I have tweaked all of the stream reassembly buffers to avoid packet loss.<br>> > Only one of the threads gets kernel packet drops. I've noticed that one CPU<br>> > is running at 100% and others are almost idle. Looking at stats.log, that<br>> > one thread for some reason is digesting more packets than others.<br>> > Throughput on this sensor is not that big. About 500k packets a minute. I<br>> > use this image on other sensors without issues.<br>> ><br>> > Need help to figure out why only one thread is doing MOST of the work.<br>> <br>> Can you share "top -H" screenshot ?<br>> <br>> ><br>> > Thank you.<br>> ><br>> > _______________________________________________<br>> > Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a><br>> > Site: <a href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a><br>> > List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>> > Suricata User Conference November 4 & 5 in Barcelona: <a href="http://oisfevents.net">http://oisfevents.net</a><br>> <br>> <br>> <br>> -- <br>> Regards,<br>> Peter Manev<o:p></o:p></span></p></div></div></div></body></html>