<html><head><style>p{margin-top:0px;margin-bottom:0px;}</style></head><body><div style="font-size:10pt; font-family:Gulim;"><p> </p><p style="padding: 0px 0px 0px 10pt; font-family: sans-serif; font-size: 10pt;"><span>-----Original Message-----</span><br><b>From:</b> "Peter Manev"<petermanev@gmail.com> <br><b>To:</b> "박경호"<pgh5247@naver.com>; <br><b>Cc:</b> "Andreas Herz"<andi@geekosphere.org>; "oisf-users@lists.openinfosecfoundation.org"<oisf-users@lists.openinfosecfoundation.org>; <br><b>Sent:</b> 2017-02-04 (토) 00:32:06<br><b>Subject:</b> Re: [Oisf-users] [Question] suricata test with pcap-file(After upgrading the suricata version(2.0.11 --> 3.2))<br> </p><p>On Wed, Feb 1, 2017 at 4:13 AM, 박경호 <pgh5247@naver.com> wrote:<br>><br>><br>><br>> -----Original Message-----<br>> From: "Peter Manev"<petermanev@gmail.com><br>> To: "박경호"<pgh5247@naver.com>;<br>> Cc: "Andreas Herz"<andi@geekosphere.org>; "oisf-users@lists.openinfosecfoundation.org"<oisf-users@lists.openinfosecfoundation.org>;<br>> Sent: 2017-01-31 (화) 18:55:58<br>> Subject: Re: [Oisf-users] [Question] suricata test with pcap-file(After upgrading the suricata version(2.0.11 --> 3.2))<br>><br>><br>> On Tue, Jan 31, 2017 at 10:20 AM, 박경호 <pgh5247@naver.com> wrote:<br>> ><br>> > Thank you for your efforts.<br>> ><br>> > i was also able to have consistent number of logs/alerts through all the pcap runs (with --runmode=single) with the provided pcap and other pcap files.<br>> ><br>> > When i ran the suricata the multiple pcap files with 'autofp runmode', the resulsts were different through all the pcap runs(reassemble memcap was set '2gb')<br>><br>> They should not differ for autofp as well (with the exception of some<br>> threshold rules) - did you try adjusting the segment's prealloc size<br>> if you have segment memcap hits in the stats.log?(dont forget to<br>> reorder the resulting pcap as well)<br>><br>> ==> How can i adjust segment's prealloc size? and how can i know if it is or not to segment memcap hits in the stats.log?<br>><br><br>With the adjustment that you have previously shown/ attached i think<br>you should be good<br>- size: 1460</p><p>==> yes, I attached the prealloc 1024 about size 1460 in segment part.<br><br>A hint for not having the right segment size or not enough of it can<br>be from - tcp.segment_memcap_drop in stats .log</p><p>==> It's no message about tcp.segment_memcpa_drop in stat.log</p><p> and i couldn't find the segment warning in suricata.log file.</p><p> </p><p>I couldn't have same alert messages whenever i ran the suricata with autofp runmode.</p><p>(i uploaded the small pcap file(about 2MB) to use for test in google drive : <a href="https://drive.google.com/open?id=0B4Mdb8bpuRlnemk5cVBOcDFKblk">https://drive.google.com/open?id=0B4Mdb8bpuRlnemk5cVBOcDFKblk</a> )</p><p>And, i set the stream configuration info. like following:</p><p> </p><p>runmode : single</p><p> </p><p>flow:</p><p> memcap: 1gb</p><p> hash-size: 65536</p><p> prealloc: 1000000</p><p> </p><p>stream:</p><p> memcap : 512mb</p><p> checksum-validation: yes</p><p> inline: no</p><p> reassembly:</p><p> memcap: 1gb</p><p> depth: 2mb</p><p> toserver-chunk-size: 2560</p><p> toclient-chunk-size: 2560</p><p> randomize-chunk-size: yes</p><p> #randomize-chunk-range: 10</p><p> raw: yes</p><p> chunk-prealloc: 1000</p><p> segments:</p><p> -size: 4</p><p> prealloc: 256</p><p> -size: 16</p><p> prealloc: 512</p><p> -size: 40</p><p> prealloc: 1024</p><p> -size: 112</p><p> prealloc: 512</p><p> -size: 248</p><p> prealloc: 512</p><p> -size: 512</p><p> prealloc: 512</p><p> -size: 768</p><p> prealloc: 1024</p><p> -size: 1448</p><p> prealloc: 1024</p><p> -size: 1460</p><p> prealloc: 1024 </p><p> -size: 65535</p><p> prealloc: 128</p><p> #zero-copy-size: 128<br>> There was a feature pushed recently to git master that is aiming at<br>> automating this a bit (<br>> <a href="https://redmine.openinfosecfoundation.org/projects/suricata/repository/revisions/master/entry/suricata.yaml.in#L1223">https://redmine.openinfosecfoundation.org/projects/suricata/repository/revisions/master/entry/suricata.yaml.in#L1223</a><br>> ).<br>><br>> ==> i changed the reassembly memcap and segments in suricata.yaml like following:<br>><br>><br>> Thanks<br>><br>><br>><br>> --<br>> Regards,<br>> Peter Manev<br>><br><br><br><br><br>-- <br>Regards,<br>Peter Manev<br> </p></div></body></html>
<table style="display:none"><tr><td><img src="https://mail.naver.com/readReceipt/notify/?img=19YdKokcpXgdax2whAnXKqMlpotwKrEqpoK9FoE9FqkSKrulF6KlFrKwFvIo%2BrkSKot5W4d5W4C5bX0q%2BzkR74FTWx%2FsWr0qpS99brkZbdIn1BFdbZlTbzk516l4WXF0MrpT%2B6lvMB3GWr%2F5WXiN.gif" border="0"></td></tr></table>