<div dir="ltr">Thanks Craig, I tried increasing SNF_DATARING_SIZE, but that variable gets overwritten and controlled by pcap.buffer-size in suricata.yml file which allows a max of 2gb, can't set more than that.<div>Hence setting SNF_DATARING_SIZE explicitly has no effect since. </div><div><br></div><div>This has been done:</div><div><span style="color:rgb(51,51,51);font-family:Verdana,sans-serif;font-size:12px">The following pull request opened by Myricom in the libpcap project indicates that a future SNF software release could provide support for setting the SNF_DATARING_SIZE via the pcap.buffer-size yaml setting:</span><br></div><div>Ref: <a class="external" href="https://github.com/the-tcpdump-group/libpcap/pull/435" style="color:rgb(198,26,26);background-position:0% 60%;background-repeat:no-repeat;padding-left:12px;background-image:url("../images/external.png");font-family:Verdana,sans-serif;font-size:12px">https://github.com/the-tcpdump-group/libpcap/pull/435</a><br><div><br></div><div><br></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Jun 19, 2020 at 11:09 AM Edgmand, Craig <<a href="mailto:craig.edgmand@okstate.edu">craig.edgmand@okstate.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_7964226538806684005WordSection1">
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Hi Fetema,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Not an expert, but have you tried increasing these<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)"><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">SNF_DATARING_SIZE=4096MB</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)"><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">SNF_DESCRING_SIZE=1024MB</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">If you have the memory, I would multiply these by a factor of 4. On my servers these numbers are huge. Might also increase buffer size.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Thanks,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Craig<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<div>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif"> Oisf-users <<a href="mailto:oisf-users-bounces@lists.openinfosecfoundation.org" target="_blank">oisf-users-bounces@lists.openinfosecfoundation.org</a>>
<b>On Behalf Of </b>fatema bannatwala<br>
<b>Sent:</b> Friday, June 19, 2020 12:59 PM<br>
<b>To:</b> Open Information Security Foundation <<a href="mailto:oisf-users@lists.openinfosecfoundation.org" target="_blank">oisf-users@lists.openinfosecfoundation.org</a>><br>
<b>Subject:</b> [Oisf-users] Capture loss ~50% reported using Myricom with Suri v 5.0.2<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div style="border:1pt solid black;padding:2pt;max-width:90%">
<p class="MsoNormal" align="center" style="text-align:center;background:rgb(245,208,122)">
<strong><span style="color:rgb(127,22,6)">CAUTION:</span></strong><span style="color:black"> This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe
<u></u><u></u></span></p>
</div>
<div>
<div>
<p class="MsoNormal">Hello Experts, <u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Need some help tuning down our prod suricata box running Suricata v 5.0.2 with Myricom NIC: 10G-PCIE-8B-S myri_snf 3.0.20.50894<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">It is consistently reporting ~50% capture loss, calculated based off of the capture.kernel_packets and capture.kernel_dropped values reported in stats.log file.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I have followed the <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fblog.inliniac.net%2F2012%2F07%2F10%2Fsuricata-on-myricom-capture-cards%2F&data=02%7C01%7Ccraig.edgmand%40okstate.edu%7Cfebd2ad7dac24eddbea508d8147a76d5%7C2a69c91de8494e34a230cdf8b27e1964%7C0%7C1%7C637281863494345977&sdata=XcrXhcZVFFiw280MZJxI6JVssD%2BdlYEyyYJJdsSIxLg%3D&reserved=0" target="_blank">https://blog.inliniac.net/2012/07/10/suricata-on-myricom-capture-cards/</a><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">guide to pin the cpus to the worker nodes and use pcap.buffer_size to increase the SNF dataring size, but no effect..<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">We have one Myri card connected to p2p1 and two NUMA nodes, each with 8 cores (16 HT):<u></u><u></u></p>
</div>
<p class="MsoNormal">NUMA node0 CPU(s): 0-7,16-23<br>
NUMA node1 CPU(s): 8-15,24-31 <u></u><u></u></p>
<div>
<p class="MsoNormal">OS: Centos 7<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Any help in the right direction would be appreciated! :)<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Thanks!<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Fatema<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Following is settings from suricata.yml file<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)"><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"># Myricom support</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)"><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">pcap:</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)"><span class="gmail-m_7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">- interface: p2p1</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)"><span class="gmail-m_7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">threads: 14</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)"><span class="gmail-m_7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">buffer-size: 2gb</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)"><span class="gmail-m_7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">checksum-checks: no</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)"><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">pcap-file:</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"> </span></span><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">checksum-checks: auto</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><br>
<br>
<u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">threading:</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">set-cpu-affinity: yes</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">cpu-affinity:</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">- management-cpu-set:</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">cpu: [ "0" ]</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">mode: "balanced"</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">prio:</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">default: "low"</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">- worker-cpu-set:</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">cpu: [ "1-7","9-15" ]</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">mode: "exclusive"</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">prio:</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">default: "high"</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><br>
<br>
<u></u><u></u></span></p>
<p class="MsoNormal">Following is the currently recorded stats.log:<u></u><u></u></p>
</div>
<div>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">------------------------------------------------------------------------------------</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">Date: 6/19/2020 -- 10:55:36 (uptime: 0d, 04h 04m 10s)</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">------------------------------------------------------------------------------------</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">Counter
</span></span><span class="gmail-m_7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">| TM Name
</span></span><span class="gmail-m_7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">| Value</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">------------------------------------------------------------------------------------</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">capture.kernel_packets</span></span><span class="gmail-m_7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">| Total
</span></span><span class="gmail-m_7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">| 28447139411</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">capture.kernel_drops</span></span><span class="gmail-m_7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">| Total
</span></span><span class="gmail-m_7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">| 27910518132</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">capture.kernel_ifdrops</span></span><span class="gmail-m_7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">| Total
</span></span><span class="gmail-m_7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">| 6034</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">decoder.pkts</span></span><span class="gmail-m_7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">| Total
</span></span><span class="gmail-m_7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">| 536633135</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
</div>
<div>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u> <u></u></span></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<p class="MsoNormal">SNF parameters:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><br>
<br>
<u></u><u></u></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u> <u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)"><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">SNF_APP_ID=32</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)"><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">SNF_DATARING_SIZE=4096MB</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)"><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">SNF_DESCRING_SIZE=1024MB</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)"><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">SNF_NUM_RINGS=14</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)"><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">SNF_FLAGS=0x1</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p2" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);min-height:18px">
<span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u> <u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)"><span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">LD_PRELOAD="/opt/snf/lib/libpcap.so.1"</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p2" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);min-height:18px">
<span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u> <u></u></span></p>
<p class="gmail-m_7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">OPTIONS="--user suricata --group suricata --pcap"</span></span><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"><u></u><u></u></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote></div>