<div dir="ltr"><div dir="ltr"><div dir="ltr">Hi Peter,<div><br></div><div>Yes, of course.</div><div><div><div>Here you have stats.log for Node2:</div><div><br></div><div>Date:9/13/2018--06:37:42(uptime:6d,17h05m59s)</div><div>------------------------------------------------------------------------------------</div><div>Counter<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|TMName<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Value</div><div>------------------------------------------------------------------------------------</div><div>capture.kernel_packets<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|135374454</div><div>capture.kernel_drops<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|11430384</div><div>decoder.pkts<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|123946335</div><div>decoder.bytes<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|122943123694</div><div>decoder.ipv4<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|123767936</div><div>decoder.ipv6<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|5036</div><div>decoder.ethernet<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|123946335</div><div>decoder.tcp<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|120082602</div><div>decoder.udp<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|683567</div><div>decoder.icmpv4<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|114883</div><div>decoder.icmpv6<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|189</div><div>decoder.tered<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|5</div><div>decoder.avg_pkt_size<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|991</div><div>decoder.max_pkt_size<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|1514</div><div>flow.tcp<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|780742</div><div>flow.udp<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|305951</div><div>flow.icmpv6<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|162</div><div>tcp.sessions<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|727356</div><div>tcp.syn<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|771112</div><div>tcp.synack<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|720764</div><div>tcp.rst<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|549359</div><div>tcp.stream_depth_reached<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|454</div><div>tcp.reassembly_gap<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|7722</div><div>tcp.overlap<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|483624</div><div>detect.alert<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|4</div><div>app_layer.flow.http<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|108080</div><div>app_layer.tx.http<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|262748</div><div>app_layer.flow.smtp<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|7</div><div>app_layer.tx.smtp<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|7</div><div>app_layer.flow.tls<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|6612</div><div>app_layer.flow.ssh<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|13</div><div>app_layer.flow.smb<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|55361</div><div>app_layer.flow.dcerpc_tcp<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|202204</div><div>app_layer.flow.dns_tcp<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|10</div><div>app_layer.tx.dns_tcp<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|10</div><div>app_layer.flow.failed_tcp<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|274419</div><div>app_layer.flow.dcerpc_udp<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|4</div><div>app_layer.flow.dns_udp<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|139325</div><div>app_layer.tx.dns_udp<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|239577</div><div>app_layer.flow.failed_udp<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|166622</div><div>flow_mgr.closed_pruned<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|684943</div><div>flow_mgr.new_pruned<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|290500</div><div>flow_mgr.est_pruned<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|110950</div><div>flow.spare<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|10000</div><div>flow.tcp_reuse<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|6055</div><div>flow_mgr.flows_checked<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|12</div><div>flow_mgr.flows_notimeout<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|5</div><div>flow_mgr.flows_timeout<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|7</div><div>flow_mgr.flows_timeout_inuse<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|1</div><div>flow_mgr.flows_removed<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|6</div><div>flow_mgr.rows_checked<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|65536</div><div>flow_mgr.rows_skipped<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|65522</div><div>flow_mgr.rows_empty<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|2</div><div>flow_mgr.rows_maxlen<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|1</div><div>tcp.memuse<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|4587520</div><div>tcp.reassembly_memuse<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|6650304</div><div>dns.memuse<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|16386</div><div>http.memuse<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|12142178</div><div>flow.memuse<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|7207360</div><div><br></div><div>And just for a reference stats.log for Node1:</div><div><br></div><div>Date:9/13/2018--06:35:39(uptime:6d,16h39m54s)</div><div>------------------------------------------------------------------------------------</div><div>Counter<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|TMName<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Value</div><div>------------------------------------------------------------------------------------</div><div>capture.kernel_packets<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|3577965800</div><div>capture.kernel_drops<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|3416155</div><div>decoder.pkts<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|3574589712</div><div>decoder.bytes<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|3536139875210</div><div>decoder.invalid<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|10070</div><div>decoder.ipv4<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|3571132083</div><div>decoder.ipv6<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|143756</div><div>decoder.ethernet<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|3574589712</div><div>decoder.tcp<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|3522243739</div><div>decoder.udp<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|34827953</div><div>decoder.icmpv4<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|963831</div><div>decoder.icmpv6<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|33551</div><div>decoder.teredo<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|1399</div><div>decoder.avg_pkt_size<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|989</div><div>decoder.max_pkt_size<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|1534</div><div>flow.tcp<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|1144524</div><div>flow.udp<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|202960</div><div>flow.icmpv6<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|439</div><div>decoder.ipv4.trunc_pkt<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|10070</div><div>tcp.sessions<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|341278</div><div>tcp.ssn_memcap_drop<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|4446979</div><div>tcp.pseudo<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|84</div><div>tcp.invalid_checksum<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|4</div><div>tcp.syn<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|6653717</div><div>tcp.synack<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|2572744</div><div>tcp.rst<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|1857715</div><div>tcp.segment_memcap_drop<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|10</div><div>tcp.stream_depth_reached<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|303</div><div>tcp.reassembly_gap<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|95648</div><div>tcp.overlap<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|3889304</div><div>tcp.insert_data_normal_fail<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|3314483</div><div>detect.alert<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|518</div><div>app_layer.flow.http<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|34820</div><div>app_layer.tx.http<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|60759</div><div>app_layer.flow.ftp<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|20</div><div>app_layer.flow.smtp<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|140</div><div>app_layer.tx.smtp<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|177</div><div>app_layer.flow.tls<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|43356</div><div>app_layer.flow.smb<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|3430</div><div>app_layer.flow.dcerpc_tcp<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|8894</div><div>app_layer.flow.dns_tcp<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|48</div><div>app_layer.tx.dns_tcp<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|46</div><div>app_layer.flow.failed_tcp<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|107518</div><div>app_layer.flow.dcerpc_udp<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|5</div><div>app_layer.flow.dns_udp<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|114888</div><div>app_layer.tx.dns_udp<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|482904</div><div>app_layer.flow.failed_udp<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|88067</div><div>flow_mgr.closed_pruned<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|259368</div><div>flow_mgr.new_pruned<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|981024</div><div>flow_mgr.est_pruned<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|107531</div><div>flow.spare<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|10000</div><div>flow.tcp_reuse<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|29932</div><div>flow_mgr.rows_checked<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|65536</div><div>flow_mgr.rows_skipped<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|65536</div><div>tcp.memuse<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|4587520</div><div>tcp.reassembly_memuse<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|655360</div><div>dns.memcap_global<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|1086836</div><div>flow.memuse<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|Total<span class="gmail-Apple-tab-span" style="white-space:pre"> </span>|7074304</div></div></div><div><br></div><div>Thank you for any suggestions.</div><div><br></div><div>Best,</div><div>magmi</div></div></div></div><br><div class="gmail_quote"><div dir="ltr">On Wed, 12 Sep 2018 at 16:16, Peter Manev <<a href="mailto:petermanev@gmail.com">petermanev@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Wed, Sep 12, 2018 at 10:57 AM Magmi A <<a href="mailto:magmi.sec@gmail.com" target="_blank">magmi.sec@gmail.com</a>> wrote:<br>
><br>
><br>
>> > * Node1 receives ~ 500Mbps of traffic (it's 1Gbps interface), and gets in average 1-2% kernel packet dropped<br>
>> > while<br>
>> > * Node2 receives ~ 500kbps of traffic and gets in average 10% kernel packet dropped<br>
>><br>
>> What is different between node 1 and node 2 ? (same config/same<br>
>> suricata/same HW/same rules...?)]<br>
><br>
><br>
> The nodes have the same HW, run the same config/ suricata version, have the same set of rules.<br>
><br>
> The only difference is that they are exposed to different sources of traffic.<br>
> From Wireshark analysis the protocol hierarchies for both cases seem similar - there is no spectacular difference.<br>
><br>
> So really the only difference is the captured traffic itself (MACs, IPs, partly protocols, data etc).<br>
><br>
> That is why we have such a problem how to approach the problem and troubleshoot it.<br>
<br>
<br>
Can you share full update of the latest stats.log ?<br>
<br>
<br>
<br>
-- <br>
Regards,<br>
Peter Manev<br>
</blockquote></div>