<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<div id="divtagdefaultwrapper" dir="ltr" style="font-size: 12pt; color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;">
<p style="margin-top:0; margin-bottom:0">I have attached the results using --pcap=p1p1 utilizing a modified version of Michal's script.</p>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Oisf-users <oisf-users-bounces@lists.openinfosecfoundation.org> on behalf of Victor Julien <lists@inliniac.net><br>
<b>Sent:</b> Monday, August 27, 2018 4:00:17 PM<br>
<b>To:</b> oisf-users@lists.openinfosecfoundation.org<br>
<b>Subject:</b> Re: [Oisf-users] Myricom and Suricata</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">On 27-08-18 22:26, Edgmand, Craig wrote:<br>
> I edited the pcap entry in suricata.yaml<br>
> <br>
> pcap:<br>
> - interface: p1p1<br>
> threads: 16<br>
> buffer-size: 2gb<br>
> promisc: no<br>
> <br>
> I ran variations of this command..<br>
> <br>
> # SNF_NUM_RINGS=16 SNF_DEBUG_MASK=3 SNF_DATARING_SIZE=4294967296<br>
> SNF_DESCRING_SIZE=1073741824 /opt/suricata/bin/suricata -i p1p1 -c<br>
> /opt/suricata/etc/suricata/suricata.yaml -v --runmode=workers<br>
> <br>
> After running these you look at myri_counters it shows no packets using<br>
> the sniffer interface.<br>
> <br>
> SNF recv pkts: 0<br>
> SNF drop ring full: 0<br>
> <br>
> If you try to run the tests using the snf0 interface, suricata dies.<br>
<br>
How does it die? Any errors?<br>
<br>
<br>
> Any thoughts? I have reviewed the documentation from Myricom and<br>
> Suricata as well.<br>
> <br>
> Thanks,<br>
<br>
What happens if you replace -i p1p1 with --pcap=p1p1 ?<br>
<br>
<br>
<br>
-- <br>
---------------------------------------------<br>
Victor Julien<br>
<a href="https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.inliniac.net%2F&data=02%7C01%7Ccraig.edgmand%40okstate.edu%7C45b5a1b6273b4c27815a08d60c6023c8%7C2a69c91de8494e34a230cdf8b27e1964%7C0%7C0%7C636710004388911723&sdata=spY%2BvdP65JErcOQvjxy%2FJl5eqHoW1hisylGUt3IJRwc%3D&reserved=0" id="LPlnk759165" class="OWAAutoLink" previewremoved="true">https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.inliniac.net%2F&data=02%7C01%7Ccraig.edgmand%40okstate.edu%7C45b5a1b6273b4c27815a08d60c6023c8%7C2a69c91de8494e34a230cdf8b27e1964%7C0%7C0%7C636710004388911723&sdata=spY%2BvdP65JErcOQvjxy%2FJl5eqHoW1hisylGUt3IJRwc%3D&reserved=0</a><br>
PGP: <a href="https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.inliniac.net%2Fvictorjulien.asc&data=02%7C01%7Ccraig.edgmand%40okstate.edu%7C45b5a1b6273b4c27815a08d60c6023c8%7C2a69c91de8494e34a230cdf8b27e1964%7C0%7C0%7C636710004388911723&sdata=2KSyZnz6%2FKk2dR07cAAe1RWoJmFtEgEXazKZHibRC1I%3D&reserved=0" id="LPlnk3212" class="OWAAutoLink" previewremoved="true">
https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.inliniac.net%2Fvictorjulien.asc&data=02%7C01%7Ccraig.edgmand%40okstate.edu%7C45b5a1b6273b4c27815a08d60c6023c8%7C2a69c91de8494e34a230cdf8b27e1964%7C0%7C0%7C636710004388911723&sdata=2KSyZnz6%2FKk2dR07cAAe1RWoJmFtEgEXazKZHibRC1I%3D&reserved=0</a><br>
---------------------------------------------<br>
<br>
_______________________________________________<br>
Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>
Site: <a href="https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsuricata-ids.org&data=02%7C01%7Ccraig.edgmand%40okstate.edu%7C45b5a1b6273b4c27815a08d60c6023c8%7C2a69c91de8494e34a230cdf8b27e1964%7C0%7C0%7C636710004388911723&sdata=W2GAk%2Bhw5NklBFqQnRQF28XekU0a22lKj5uN9IN2AZw%3D&reserved=0" id="LPlnk292094" class="OWAAutoLink" previewremoved="true">
https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsuricata-ids.org&data=02%7C01%7Ccraig.edgmand%40okstate.edu%7C45b5a1b6273b4c27815a08d60c6023c8%7C2a69c91de8494e34a230cdf8b27e1964%7C0%7C0%7C636710004388911723&sdata=W2GAk%2Bhw5NklBFqQnRQF28XekU0a22lKj5uN9IN2AZw%3D&reserved=0</a>
| Support: <a href="https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsuricata-ids.org%2Fsupport%2F&data=02%7C01%7Ccraig.edgmand%40okstate.edu%7C45b5a1b6273b4c27815a08d60c6023c8%7C2a69c91de8494e34a230cdf8b27e1964%7C0%7C0%7C636710004388921728&sdata=z1vKDUdzzLKwL66I52wgMXngeU1j4pDrxWQh3ifmXLY%3D&reserved=0" id="LPlnk239930" class="OWAAutoLink" previewremoved="true">
https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsuricata-ids.org%2Fsupport%2F&data=02%7C01%7Ccraig.edgmand%40okstate.edu%7C45b5a1b6273b4c27815a08d60c6023c8%7C2a69c91de8494e34a230cdf8b27e1964%7C0%7C0%7C636710004388921728&sdata=z1vKDUdzzLKwL66I52wgMXngeU1j4pDrxWQh3ifmXLY%3D&reserved=0</a><br>
List: <a href="https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.openinfosecfoundation.org%2Fmailman%2Flistinfo%2Foisf-users&data=02%7C01%7Ccraig.edgmand%40okstate.edu%7C45b5a1b6273b4c27815a08d60c6023c8%7C2a69c91de8494e34a230cdf8b27e1964%7C0%7C0%7C636710004388921728&sdata=4dzGqPuW4HfCziBmWkThO19U%2F4CGEzWLAcnc979aiPA%3D&reserved=0" id="LPlnk953065" class="OWAAutoLink" previewremoved="true">
https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.openinfosecfoundation.org%2Fmailman%2Flistinfo%2Foisf-users&data=02%7C01%7Ccraig.edgmand%40okstate.edu%7C45b5a1b6273b4c27815a08d60c6023c8%7C2a69c91de8494e34a230cdf8b27e1964%7C0%7C0%7C636710004388921728&sdata=4dzGqPuW4HfCziBmWkThO19U%2F4CGEzWLAcnc979aiPA%3D&reserved=0</a><br>
<br>
Conference: <a href="https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsuricon.net&data=02%7C01%7Ccraig.edgmand%40okstate.edu%7C45b5a1b6273b4c27815a08d60c6023c8%7C2a69c91de8494e34a230cdf8b27e1964%7C0%7C0%7C636710004388921728&sdata=B23x1fywCTG48bPdtuapSRuzj%2BIoOERK4MC6zefH5C4%3D&reserved=0" id="LPlnk121698" class="OWAAutoLink" previewremoved="true">
https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsuricon.net&data=02%7C01%7Ccraig.edgmand%40okstate.edu%7C45b5a1b6273b4c27815a08d60c6023c8%7C2a69c91de8494e34a230cdf8b27e1964%7C0%7C0%7C636710004388921728&sdata=B23x1fywCTG48bPdtuapSRuzj%2BIoOERK4MC6zefH5C4%3D&reserved=0</a><br>
Trainings: <a href="https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsuricata-ids.org%2Ftraining%2F&data=02%7C01%7Ccraig.edgmand%40okstate.edu%7C45b5a1b6273b4c27815a08d60c6023c8%7C2a69c91de8494e34a230cdf8b27e1964%7C0%7C0%7C636710004388921728&sdata=hBolBaPWnbONe70GkP3I6SGTfIp9IoH%2FOgIu0ugo%2FtU%3D&reserved=0" id="LPlnk7737" class="OWAAutoLink" previewremoved="true">
https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsuricata-ids.org%2Ftraining%2F&data=02%7C01%7Ccraig.edgmand%40okstate.edu%7C45b5a1b6273b4c27815a08d60c6023c8%7C2a69c91de8494e34a230cdf8b27e1964%7C0%7C0%7C636710004388921728&sdata=hBolBaPWnbONe70GkP3I6SGTfIp9IoH%2FOgIu0ugo%2FtU%3D&reserved=0</a></div>
</span></font></div>
</div>
</body>
</html>