<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:rgb(0,0,0); font-family:Calibri,Helvetica,sans-serif,"EmojiFont","Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols">
<p style="margin-top:0; margin-bottom:0">Hello,</p>
<p style="margin-top:0; margin-bottom:0"><br>
</p>
<p style="margin-top:0; margin-bottom:0">I shall answer... starting with explaining the setup using either afpacket or pfring natively and on their own to suricata with processes and interrupts nicely pinned there are no concerns and some impressively satisfying
results. </p>
<p style="margin-top:0; margin-bottom:0"><br>
</p>
<p style="margin-top:0; margin-bottom:0">Alas, this sensor box also requires multiple tools and essentially multi-tennant and not everything plays well. So, configuring up kvm instances to give a 'customer' their own rooms for just their packets or native
processes, lua scripts etc which is also now working. There is of course some cache coherency blips which will wait for another day when it really bites - the list discussion recently about affinity have been good food but for now I have to focus on the operations
and getting a service running.<br>
</p>
<p style="margin-top:0; margin-bottom:0"><br>
</p>
<p style="margin-top:0; margin-bottom:0">The workaround, and currently somehow working, is to use zbalance_ipc on the actual nic and remap an output to a dummy interface. suricata appears happy to read from this single interface with with no kernel drops to
give many threads to the worker cores. i guess at some stage multiple kernel bypass methods may melt a bus somewhere, and there are very likely better ways, but for now I have something working. Lowering rx nic queues seems to have helped.</p>
<p style="margin-top:0; margin-bottom:0"><br>
</p>
<p style="margin-top:0; margin-bottom:0">Regards,<br>
Kerry</p>
<p style="margin-top:0; margin-bottom:0"><br>
</p>
<p style="margin-top:0; margin-bottom:0"><br>
</p>
<p style="margin-top:0; margin-bottom:0"><br>
</p>
<p style="margin-top:0; margin-bottom:0"><br>
</p>
<p style="margin-top:0; margin-bottom:0"><br>
</p>
<p style="margin-top:0; margin-bottom:0"><br>
</p>
<br>
<br>
<div style="color:rgb(0,0,0)">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" color="#000000" face="Calibri, sans-serif"><b>From:</b> Oisf-users <oisf-users-bounces@lists.openinfosecfoundation.org> on behalf of Kerry Milestone <Kerry.Milestone@ed.ac.uk><br>
<b>Sent:</b> 06 March 2018 11:54<br>
<b>To:</b> oisf-users@lists.openinfosecfoundation.org<br>
<b>Subject:</b> [Oisf-users] _fail Stats Q</font></div>
</div>
</div>
</body>
</html>