<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 3.0cm 70.85pt 3.0cm;}
div.WordSection1
{page:WordSection1;}
--></style></head><body lang=PT link=blue vlink="#954F72"><div class=WordSection1><p class=MsoNormal>Hey,</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>in irqbalance, you have to blacklist the IRQs used by the network card. Then you have to set the IRQ CPU affinity correctly. Then you have to configure suricata threading and CPU affinity settings.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>These are guidelines that I follow to setup suri. If you need more help, as Andreas stated, we need more info (rin mode, configd, etc.)</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Cheers <span style='font-family:"Segoe UI Emoji",sans-serif'>😊</span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman",serif'><o:p> </o:p></span></p><div style='mso-element:para-border-div;border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal style='border:none;padding:0cm'><b>De: </b><a href="mailto:andi@geekosphere.org">Andreas Herz</a><br><b>Enviado: </b>29 de maio de 2016 00:32<br><b>Para: </b><a href="mailto:oisf-users@lists.openinfosecfoundation.org">oisf-users@lists.openinfosecfoundation.org</a><br><b>Assunto: </b>Re: [Oisf-users] Suricata with IRQBalance</p></div><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman",serif'><o:p> </o:p></span></p><p class=MsoNormal>On 23/05/16 at 19:27, Yasha Zislin wrote:</p><p class=MsoNormal>> Does anybody use IRQBalance to ballance interrupts for nic processing?</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Peter Manev knows more about IRQs :)</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>> I have set up IRQBalance service (in CentOS).</p><p class=MsoNormal>> </p><p class=MsoNormal>> After viewing stats in /proc/interrupts, I feel like it is not working.</p><p class=MsoNormal>> </p><p class=MsoNormal>> CPU0 CPU1 CPU2 CPU3</p><p class=MsoNormal>> </p><p class=MsoNormal>> 56: 0 0 0 337763094 PCI-MSI-edge eth0</p><p class=MsoNormal>> 57: 0 0 0 0 PCI-MSI-edge eth0:1</p><p class=MsoNormal>> 58: 0 0 0 0 PCI-MSI-edge eth0:2</p><p class=MsoNormal>> 59: 0 0 0 0 PCI-MSI-edge eth0:3</p><p class=MsoNormal>> </p><p class=MsoNormal>> It looks like only one CPU is doing the work here. Am I correct?</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>How did you do the setup?</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>> In the past I have tried configuring affinity in Suricata config and had hard time since Packet Loss would even get worse.</p><p class=MsoNormal>> </p><p class=MsoNormal>> Are there any guides on how to configure CPU interrupts for Suricata? I feel like I am loosing performance here.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Do you have any more details about that behaviour?</p><p class=MsoNormal>Which version are you running in what capture/runmode?</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>> </p><p class=MsoNormal>> Thank you.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>> _______________________________________________</p><p class=MsoNormal>> Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org</p><p class=MsoNormal>> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/</p><p class=MsoNormal>> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</p><p class=MsoNormal>> Suricata User Conference November 9-11 in Washington, DC: http://oisfevents.net</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>-- </p><p class=MsoNormal>Andreas Herz</p><p class=MsoNormal>_______________________________________________</p><p class=MsoNormal>Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org</p><p class=MsoNormal>Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/</p><p class=MsoNormal>List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</p><p class=MsoNormal>Suricata User Conference November 9-11 in Washington, DC: http://oisfevents.net</p><p class=MsoNormal><o:p> </o:p></p></div></body></html>e" UnhideWhenUsed="true" Name="envelope address"/>
<w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="true" Name="envelope return"/>
<w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="t