<html><head><style>p{margin-top:0px;margin-bottom:0px;}</style></head><body><div style="font-size:10pt; font-family:Gulim;"><p> </p><p style="padding: 0px 0px 0px 10pt; font-family: sans-serif; font-size: 10pt;"><span>-----Original Message-----</span><br><b>From:</b> "Peter Manev"<petermanev@gmail.com> <br><b>To:</b> "박경호"<pgh5247@naver.com>; <br><b>Cc:</b> "Andreas Herz"<andi@geekosphere.org>; "oisf-users@lists.openinfosecfoundation.org"<oisf-users@lists.openinfosecfoundation.org>; <br><b>Sent:</b> 2017-01-31 (화) 18:55:58<br><b>Subject:</b> Re: [Oisf-users] [Question] suricata test with pcap-file(After upgrading the suricata version(2.0.11 --> 3.2))<br> </p><p>On Tue, Jan 31, 2017 at 10:20 AM, 박경호 <pgh5247@naver.com> wrote:<br>><br>> Thank you for your efforts.<br>><br>> i was also able to have consistent number of logs/alerts through all the pcap runs (with --runmode=single) with the provided pcap and other pcap files.<br>><br>> When i ran the suricata the multiple pcap files with 'autofp runmode', the resulsts were different through all the pcap runs(reassemble memcap was set '2gb')<br><br>They should not differ for autofp as well (with the exception of some<br>threshold rules) - did you try adjusting the segment's prealloc size<br>if you have segment memcap hits in the stats.log?(dont forget to<br>reorder the resulting pcap as well)</p><p>==> How can i adjust segment's prealloc size? and how can i know if it is or not to segment memcap hits in the stats.log?<br><br>There was a feature pushed recently to git master that is aiming at<br>automating this a bit (<br><a href="https://redmine.openinfosecfoundation.org/projects/suricata/repository/revisions/master/entry/suricata.yaml.in#L1223">https://redmine.openinfosecfoundation.org/projects/suricata/repository/revisions/master/entry/suricata.yaml.in#L1223</a><br>).</p><p>==> i changed the reassembly memcap and segments in suricata.yaml like following:</p><p><img src="cid:692786824ba7f29b1965d0883557454@cweb08.nm.nhnsystem.com"></p><p><br>Thanks<br><br><br><br>-- <br>Regards,<br>Peter Manev<br> </p></div></body></html>
<table style="display:none"><tr><td><img src="https://mail.naver.com/readReceipt/notify/?img=1qKdKokcpXIoFqF0hAnXKov%2FF4KZaAUZFqUrK4E%2FaAF0a6J0MruqaxigMX%2B0Mogl74lR74lcWNFlbX30WLloWrdQareGbrMR%2BBF0bNFgWz0q%2BHK5WXI0W405p4eqp6F4WXk5pzJd16e574eZpm%3D%3D.gif" border="0"></td></tr></table>