<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Menlo;
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.gmail-p1, li.gmail-p1, div.gmail-p1
{mso-style-name:gmail-p1;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.gmail-s1
{mso-style-name:gmail-s1;}
span.gmail-apple-converted-space
{mso-style-name:gmail-apple-converted-space;}
p.gmail-p2, li.gmail-p2, div.gmail-p2
{mso-style-name:gmail-p2;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle23
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Hi Fetema,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Not an expert, but have you tried increasing these<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF"><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">SNF_DATARING_SIZE=4096MB</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF"><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">SNF_DESCRING_SIZE=1024MB</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">If you have the memory, I would multiply these by a factor of 4. On my servers these numbers are huge. Might also increase buffer size.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Craig<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Oisf-users <oisf-users-bounces@lists.openinfosecfoundation.org>
<b>On Behalf Of </b>fatema bannatwala<br>
<b>Sent:</b> Friday, June 19, 2020 12:59 PM<br>
<b>To:</b> Open Information Security Foundation <oisf-users@lists.openinfosecfoundation.org><br>
<b>Subject:</b> [Oisf-users] Capture loss ~50% reported using Myricom with Suri v 5.0.2<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:solid black 1.0pt;padding:2.0pt 2.0pt 2.0pt 2.0pt;max-width:90%">
<p class="MsoNormal" align="center" style="text-align:center;background:#F5D07A">
<strong><span style="color:#7F1606">CAUTION:</span></strong><span style="color:black"> This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe
<o:p></o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal">Hello Experts, <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Need some help tuning down our prod suricata box running Suricata v 5.0.2 with Myricom NIC: 10G-PCIE-8B-S myri_snf 3.0.20.50894<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">It is consistently reporting ~50% capture loss, calculated based off of the capture.kernel_packets and capture.kernel_dropped values reported in stats.log file.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I have followed the <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fblog.inliniac.net%2F2012%2F07%2F10%2Fsuricata-on-myricom-capture-cards%2F&data=02%7C01%7Ccraig.edgmand%40okstate.edu%7Cfebd2ad7dac24eddbea508d8147a76d5%7C2a69c91de8494e34a230cdf8b27e1964%7C0%7C1%7C637281863494345977&sdata=XcrXhcZVFFiw280MZJxI6JVssD%2BdlYEyyYJJdsSIxLg%3D&reserved=0">https://blog.inliniac.net/2012/07/10/suricata-on-myricom-capture-cards/</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">guide to pin the cpus to the worker nodes and use pcap.buffer_size to increase the SNF dataring size, but no effect..<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">We have one Myri card connected to p2p1 and two NUMA nodes, each with 8 cores (16 HT):<o:p></o:p></p>
</div>
<p class="MsoNormal">NUMA node0 CPU(s): 0-7,16-23<br>
NUMA node1 CPU(s): 8-15,24-31 <o:p></o:p></p>
<div>
<p class="MsoNormal">OS: Centos 7<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Any help in the right direction would be appreciated! :)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks!<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Fatema<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Following is settings from suricata.yml file<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF"><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"># Myricom support</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF"><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">pcap:</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF"><span class="gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">
</span></span><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">- interface: p2p1</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF"><span class="gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">
</span></span><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">threads: 14</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF"><span class="gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">
</span></span><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">buffer-size: 2gb</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF"><span class="gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">
</span></span><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">checksum-checks: no</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF"><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">pcap-file:</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"> </span></span><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">checksum-checks: auto</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><br>
<br>
<o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">threading:</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">
</span></span><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">set-cpu-affinity: yes</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">
</span></span><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">cpu-affinity:</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">
</span></span><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">- management-cpu-set:</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">
</span></span><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">cpu: [ "0" ]</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">
</span></span><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">mode: "balanced"</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">
</span></span><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">prio:</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">
</span></span><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">default: "low"</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">
</span></span><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">- worker-cpu-set:</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">
</span></span><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">cpu: [ "1-7","9-15" ]</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">
</span></span><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">mode: "exclusive"</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">
</span></span><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">prio:</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">
</span></span><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">default: "high"</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><br>
<br>
<o:p></o:p></span></p>
<p class="MsoNormal">Following is the currently recorded stats.log:<o:p></o:p></p>
</div>
<div>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">------------------------------------------------------------------------------------</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">Date: 6/19/2020 -- 10:55:36 (uptime: 0d, 04h 04m 10s)</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">------------------------------------------------------------------------------------</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">Counter
</span></span><span class="gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">
</span></span><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">| TM Name
</span></span><span class="gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">
</span></span><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">| Value</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">------------------------------------------------------------------------------------</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">capture.kernel_packets</span></span><span class="gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">
</span></span><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">| Total
</span></span><span class="gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">
</span></span><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">| 28447139411</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">capture.kernel_drops</span></span><span class="gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">
</span></span><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">| Total
</span></span><span class="gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">
</span></span><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">| 27910518132</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">capture.kernel_ifdrops</span></span><span class="gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">
</span></span><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">| Total
</span></span><span class="gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">
</span></span><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">| 6034</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">decoder.pkts</span></span><span class="gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">
</span></span><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">| Total
</span></span><span class="gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">
</span></span><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">| 536633135</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
</div>
<div>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">SNF parameters:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p> </o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF"><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">SNF_APP_ID=32</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF"><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">SNF_DATARING_SIZE=4096MB</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF"><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">SNF_DESCRING_SIZE=1024MB</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF"><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">SNF_NUM_RINGS=14</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF"><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">SNF_FLAGS=0x1</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p2" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF;min-height:18px">
<span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p> </o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF"><span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">LD_PRELOAD="/opt/snf/lib/libpcap.so.1"</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
<p class="gmail-p2" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF;min-height:18px">
<span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p> </o:p></span></p>
<p class="gmail-p1" style="margin:0in;margin-bottom:.0001pt;background:#FCF8FF;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-s1"><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C">OPTIONS="--user suricata --group suricata --pcap"</span></span><span style="font-size:11.5pt;font-family:"Menlo",serif;color:#650D6C"><o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>