<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Hi Everyone,</p>
<p>I am having a problem with my Suricata setup and hope that
someone here as a hint for me:<br>
I run suricata 4.1.4 together with a myricom card on a server with
128 gigs of RAM and two 16core(+HT) Intel CPUs.<br>
The SNF settings are 30 rings and 32/8gig for ringsizes. <br>
</p>
<p>As long as I do not deploy any rules, suricata runs smoothly with
~20% CPU load per (worker) core at 9-10 Gbit/s network traffic.
However, when I deploy even small rulesets (e.g. et-shellcode) the
CPU load skyrockets with 100% for 3-6 cores and the rest at around
50%. After a few moments, packets are dropped, with the SNF drop
ring full counter increasing rapidly (at 9-10Gbit/s, as before). I
use hyperscan as mpm-algo and tried to followed the
recommendations at<a
href="https://home.regit.org/2012/07/suricata-to-10gbps-and-beyond/">
https://home.regit.org/2012/07/suricata-to-10gbps-and-beyond/ .</a><br>
However, I was not able to follow the recommendations regarding
IRQ, since those seemed pretty NIC specific. Is this setup also
relevant for myricom cards? <br>
Additionally, I obviously do not use AF_PACKET but libpcap with 30
threads. <br>
</p>
<p>To test the bandwidth I used iperf with 30 parallel connections.
Could this be the reason why only some of the cores are running at
100% load? If so, are there any other possiblities to simulate the
bandwidth more realistically?<br>
</p>
<p>Are there any myricom users here that could share performance
hints for myricom+suricata? I feel that (hardware-wise) my setup
should have no problem handling 10Gbit/s with a decent ruleset,
right?<br>
</p>
<p>Thanks a lot</p>
<p>Fabian<br>
</p>
</body>
</html>