<html><head><meta http-equiv="content-type" content="text/html; charset=ISO-8859-15"><style>body { line-height: 1.5; }blockquote { margin-top: 0px; margin-bottom: 0px; margin-left: 0.5em; }body { font-size: 10.5pt; font-family: 'Microsoft YaHei UI'; color: rgb(0, 0, 0); line-height: 1.5; }</style></head><body>
<div><span></span>Hi Eric</div><div>I counted the last 24 hours of host information: source address 7000+ destination address 1000+</div>
<div><br></div><hr style="width: 210px; height: 1px;" color="#b5c4df" size="1" align="left">
<div><span><div style="MARGIN: 10px; FONT-FAMILY: verdana; FONT-SIZE: 10pt"><div>mazhuang@17paipai.cn</div></div></span></div>
<blockquote style="margin-Top: 0px; margin-Bottom: 0px; margin-Left: 0.5em"><div> </div><div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm"><div style="PADDING-RIGHT: 8px; PADDING-LEFT: 8px; FONT-SIZE: 12px;FONT-FAMILY:tahoma;COLOR:#000000; BACKGROUND: #efefef; PADDING-BOTTOM: 8px; PADDING-TOP: 8px"><div><b>From:</b> <a href="mailto:eric@regit.org">Eric Leblond</a></div><div><b>Date:</b> 2018-10-08 14:29</div><div><b>To:</b> <a href="mailto:mazhuang@17paipai.cn">mazhuang@17paipai.cn</a>; <a href="mailto:Konstantin.Klinger@dcso.de">Konstantin Klinger</a>; <a href="mailto:michalpurzynski1@gmail.com">Michal Purzynski</a></div><div><b>CC:</b> <a href="mailto:oisf-users@lists.openinfosecfoundation.org">oisf-users</a></div><div><b>Subject:</b> Re: Re: [Oisf-users] suricata 4.1 eBpf load balance</div></div></div><div><div>Hello,</div>
<div> </div>
<div>On Mon, 2018-10-08 at 11:57 +0800, mazhuang@17paipai.cn wrote:</div>
<div>> Hi Eric</div>
<div>> I used the new code, and the permission issue was resolved, but the</div>
<div>> load balancing issue remained</div>
<div> </div>
<div>OK.</div>
<div> </div>
<div>> </div>
<div>> </div>
<div>> [root@yg suricata]# suricata --af-packet=ens4f1 --runmode=workers -c </div>
<div>> /etc/suricata/suricata.yaml -vvv</div>
<div>...</div>
<div>> dropped 0</div>
<div>> [14953] 8/10/2018 -- 11:48:11 - (source-af-packet.c:1249) <Info></div>
<div>> (AFPSwitchState) -- Cleaning socket connected to 'ens4f1'</div>
<div>> [14954] 8/10/2018 -- 11:48:11 - (source-af-packet.c:2655) <Perf></div>
<div>> (ReceiveAFPThreadExitStats) -- (W#16-ens4f1) Kernel: Packets 524725,</div>
<div>> dropped 224653</div>
<div>> [14954] 8/10/2018 -- 11:48:11 - (source-af-packet.c:1249) <Info></div>
<div>> (AFPSwitchState) -- Cleaning socket connected to 'ens4f1'</div>
<div>> [14754] 8/10/2018 -- 11:48:11 - (counters.c:815) <Info></div>
<div>> (StatsLogSummary) -- Alerts: 128</div>
<div>> [14754] 8/10/2018 -- 11:48:12 - (ippair.c:290) <Perf></div>
<div>> (IPPairPrintStats) -- ippair memory usage: 414144 bytes, maximum:</div>
<div>> 16777216</div>
<div>> [14754] 8/10/2018 -- 11:48:12 - (host.c:294) <Perf> (HostPrintStats)</div>
<div>> -- host memory usage: 604320 bytes, maximum: 33554432</div>
<div>> [14754] 8/10/2018 -- 11:48:12 - (detect-engine-build.c:1704) <Info></div>
<div>> (SigAddressCleanupStage1) -- cleaning up signature grouping</div>
<div>> structure... complete</div>
<div>> [14754] 8/10/2018 -- 11:48:12 - (util-device.c:328) <Notice></div>
<div>> (LiveDeviceListClean) -- Stats for 'ens4f1': pkts: 41029800, drop:</div>
<div>> 34453226 (83.97%), invalid chksum: 54</div>
<div> </div>
<div>It does not looks really fair indeed. What is the traffic you are</div>
<div>testing it with ? How many different hosts are involved ?</div>
<div> </div>
<div>BR,</div>
<div>-- </div>
<div>Eric Leblond <eric@regit.org></div>
</div></blockquote>
</body></html>