<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle20
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Although this is and old post, I read that MPP had little/no performance impact in this thread on
<a href="https://home.regit.org/2012/07/suricata-to-10gbps-and-beyond/">https://home.regit.org/2012/07/suricata-to-10gbps-and-beyond/</a> and these guys seem to be familiar with Suricata….
<span style="font-family:"Segoe UI Emoji",sans-serif">😉</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-family:Symbol">·</span> <img border="0" width="42" height="42" style="width:.4375in;height:.4375in" id="Picture_x0020_3" src="cid:image001.jpg@01D5CD3F.27981650"><b><a href="http://blog.inliniac.net/">Victor Julien</a></b>
says: <o:p></o:p></p>
<p class="MsoNormal"><a href="https://home.regit.org/2012/07/suricata-to-10gbps-and-beyond/#comment-71478">2012/08/10 at 14:29
</a><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Does the max-pending-packets setting really affect performance here? In workers mode the number of packets simultaneously processed should be the same as the number of threads,
plus a few for tunnel decoding and stream handling.<o:p></o:p></p>
<p class="MsoNormal"><span style="font-family:Symbol">·</span> <img border="0" width="42" height="42" style="width:.4375in;height:.4375in" id="Picture_x0020_2" src="cid:image002.jpg@01D5CD3F.27981650"><b><a href="http://home.regit.org">Regit</a></b> says:
<o:p></o:p></p>
<p class="MsoNormal"><a href="https://home.regit.org/2012/07/suricata-to-10gbps-and-beyond/#comment-71706">2012/08/12 at 08:20
</a><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">You’re right indeed. I don’t remember seeing any difference here.<o:p></o:p></p>
<p class="MsoNormal"><span style="font-family:Symbol">·</span> <img border="0" width="42" height="42" style="width:.4375in;height:.4375in" id="Picture_x0020_1" src="cid:image003.png@01D5CD3F.27981650"><b>Peter Manev</b> says:
<o:p></o:p></p>
<p class="MsoNormal"><a href="https://home.regit.org/2012/07/suricata-to-10gbps-and-beyond/#comment-72161">2012/08/18 at 13:06
</a><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">no effect in my tests…<o:p></o:p></p>
<p class="MsoNormal"><b>From:</b> Oisf-users <oisf-users-bounces@lists.openinfosecfoundation.org>
<b>On Behalf Of </b>Michal Purzynski<br>
<b>Sent:</b> Thursday, January 16, 2020 4:51 PM<br>
<b>To:</b> Eric Urban <eurban@umn.edu><br>
<b>Cc:</b> oisf-users@lists.openinfosecfoundation.org<br>
<b>Subject:</b> [EXT] Re: [Oisf-users] Need help with Suricata conf<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">We wrote guides a while back, that might help answering some of your questions. Let me address what I can, right here.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="https://github.com/pevma/SEPTun">https://github.com/pevma/SEPTun</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="https://github.com/pevma/SEPTun-Mark-II">https://github.com/pevma/SEPTun-Mark-II</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal">We are testing Suricata in af-packet IDS mode and we ran into a couple of issues with configuring.<o:p></o:p></p>
<div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal"><br>
We have various HW setups, and therefore Suricata runs in different runmodes (either workers or autofp) depending on a specific platform. Currently I'm trying to configure Suricata to get the best performance as possible, but some settings are ambiguous and
even the documentation didn't help a lot.<o:p></o:p></p>
</div>
</blockquote>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The best performance setup (for the IDS) comes from the workers runmode.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
Here are some of the things which I do not understand about configuration:<br>
<br>
1) ring-size: <number of packets> - Ring size will be computed with respect to max_pending_packets and number of threads. You can set manually the ring size in number of packets by setting the following value. So as I understand this value defines a cache size
of each thread when running in workers mode, but when running in autofp there may be different numbers of packet capture and packet processing threads. To which type of thread does the ring-size refer in autofp mode? And when this value is not set - what is
the default value?<o:p></o:p></p>
</div>
</blockquote>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">For workers mode - each threat will have its own ring, so also watch out for the memory usage. For autofp, no idea.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal">2) tpacket_v3 has such properties as block-size and block-timeout which look a bit complicated. What should I take into consideration when trying to tune those values?<o:p></o:p></p>
</div>
</blockquote>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Some good and proven in the battle numbers to start from are in above SepTun guides. Feel free to start somewhere from there and modify as you see fit.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">As a general rule, I would first modify the ring-size before touching the block-size.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">More details and diagrams here<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="https://www.kernel.org/doc/Documentation/networking/packet_mmap.txt">https://www.kernel.org/doc/Documentation/networking/packet_mmap.txt</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal"><br>
3) buffer-size: <number of bytes?> - what is this buffer?<o:p></o:p></p>
</div>
</blockquote>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">It shouldn't be there - it's not used by the AF_Packet processing pipeline. Looks like something we could remove from this section of the config file.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal"><br>
4) max-pending-packets: <number of packets> - is this a number of packets which can be simultaneously processed by each of packet processing thread?<o:p></o:p></p>
</div>
</blockquote>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">That's what I believe the documentation says, but the code makes me think it's the global per-Suricata instance limit of the maximum numbers of packets that can be queued by all of your threads, i.e.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">ring_size * threads<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Just make it generous.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal">Here is how I see it: say we set the ring-size to 100k packets, set m-p-p to 1k and run 8 packet processing threads. This setup means that each of 8 threads can analyze 1k packets at once, while other packets have to wait in its 100k packets
buffer - is it correct? And again, if this setting is commented out - what is the default value?<o:p></o:p></p>
</div>
</blockquote>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">default is 1024 (looking at the suricata.c)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I believe you should just make it larger than numbers of threads * packets per thread (so ring size).<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Victor / Eric could you either confirm or correct me?<o:p></o:p></p>
</div>
</div>
</div>
</div>
</body>
</html>