<div dir="ltr">So, I printed out the per thread stats, and it looks like the "capture.kernel_drops" for every thread (14 total) is the same as the "SNF drop ring full" counter.<div>And then the Total "capture.kernel_drops" just adds up to 14 x the per thread "capture.kernel_drops" which seems wrong?</div><div>How does Suricata calculate the "capture.kernel_drops" reported in stats.log?</div><div><br></div># /opt/snf/bin/myri_counters <br> Lanai uptime (seconds): 7060339<br> Counters uptime (seconds): 18774<br> Net send KBytes: 0<br> Net recv KBytes: 1600442598<br> SNF recv pkts: 1458428259<br> <b>SNF drop ring full:</b> <b>97865592</b><br> Interrupts: 163442397<br> Net bad PHY/CRC32 drop: 91<br><div><br></div><div>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_packets<span class="gmail-Apple-converted-space"> </span>| Total <span class="gmail-Apple-converted-space"> </span>| 2880399660</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_drops<span class="gmail-Apple-converted-space"> </span>| Total <span class="gmail-Apple-converted-space"> </span>| 1370118288</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_ifdrops<span class="gmail-Apple-converted-space"> </span>| Total <span class="gmail-Apple-converted-space"> </span>| 1512</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_packets<span class="gmail-Apple-converted-space"> </span>| W#01-p2p1 <span class="gmail-Apple-converted-space"> </span>| 249578109</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_drops<span class="gmail-Apple-converted-space"> </span>| W#01-p2p1 <span class="gmail-Apple-converted-space"> </span>| 97865592</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_ifdrops<span class="gmail-Apple-converted-space"> </span>| W#01-p2p1 <span class="gmail-Apple-converted-space"> </span>| 108</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_packets<span class="gmail-Apple-converted-space"> </span>| W#02-p2p1 <span class="gmail-Apple-converted-space"> </span>| 332169436</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_drops<span class="gmail-Apple-converted-space"> </span>| W#02-p2p1 <span class="gmail-Apple-converted-space"> </span>| 97865592</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_ifdrops<span class="gmail-Apple-converted-space"> </span>| W#02-p2p1 <span class="gmail-Apple-converted-space"> </span>| 108</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_packets<span class="gmail-Apple-converted-space"> </span>| W#03-p2p1 <span class="gmail-Apple-converted-space"> </span>| 154629355</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_drops<span class="gmail-Apple-converted-space"> </span>| W#03-p2p1 <span class="gmail-Apple-converted-space"> </span>| 97865592</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_ifdrops<span class="gmail-Apple-converted-space"> </span>| W#03-p2p1 <span class="gmail-Apple-converted-space"> </span>| 108</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_packets<span class="gmail-Apple-converted-space"> </span>| W#04-p2p1 <span class="gmail-Apple-converted-space"> </span>| 148255255</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_drops<span class="gmail-Apple-converted-space"> </span>| W#04-p2p1 <span class="gmail-Apple-converted-space"> </span>| 97865592</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_ifdrops<span class="gmail-Apple-converted-space"> </span>| W#04-p2p1 <span class="gmail-Apple-converted-space"> </span>| 108</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_packets<span class="gmail-Apple-converted-space"> </span>| W#05-p2p1 <span class="gmail-Apple-converted-space"> </span>| 149307385</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_drops<span class="gmail-Apple-converted-space"> </span>| W#05-p2p1 <span class="gmail-Apple-converted-space"> </span>| 97865592</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_ifdrops<span class="gmail-Apple-converted-space"> </span>| W#05-p2p1 <span class="gmail-Apple-converted-space"> </span>| 108</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_packets<span class="gmail-Apple-converted-space"> </span>| W#06-p2p1 <span class="gmail-Apple-converted-space"> </span>| 177628220</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_drops<span class="gmail-Apple-converted-space"> </span>| W#06-p2p1 <span class="gmail-Apple-converted-space"> </span>| 97865592</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_ifdrops<span class="gmail-Apple-converted-space"> </span>| W#06-p2p1 <span class="gmail-Apple-converted-space"> </span>| 108</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_packets<span class="gmail-Apple-converted-space"> </span>| W#07-p2p1 <span class="gmail-Apple-converted-space"> </span>| 322356666</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_drops<span class="gmail-Apple-converted-space"> </span>| W#07-p2p1 <span class="gmail-Apple-converted-space"> </span>| 97865592</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_ifdrops<span class="gmail-Apple-converted-space"> </span>| W#07-p2p1 <span class="gmail-Apple-converted-space"> </span>| 108</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_packets<span class="gmail-Apple-converted-space"> </span>| W#08-p2p1 <span class="gmail-Apple-converted-space"> </span>| 173429446</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_drops<span class="gmail-Apple-converted-space"> </span>| W#08-p2p1 <span class="gmail-Apple-converted-space"> </span>| 97865592</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_ifdrops<span class="gmail-Apple-converted-space"> </span>| W#08-p2p1 <span class="gmail-Apple-converted-space"> </span>| 108</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_packets<span class="gmail-Apple-converted-space"> </span>| W#09-p2p1 <span class="gmail-Apple-converted-space"> </span>| 156447639</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_drops<span class="gmail-Apple-converted-space"> </span>| W#09-p2p1 <span class="gmail-Apple-converted-space"> </span>| 97865592</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_ifdrops<span class="gmail-Apple-converted-space"> </span>| W#09-p2p1 <span class="gmail-Apple-converted-space"> </span>| 108</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_packets<span class="gmail-Apple-converted-space"> </span>| W#10-p2p1 <span class="gmail-Apple-converted-space"> </span>| 303111334</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_drops<span class="gmail-Apple-converted-space"> </span>| W#10-p2p1 <span class="gmail-Apple-converted-space"> </span>| 97865592</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_ifdrops<span class="gmail-Apple-converted-space"> </span>| W#10-p2p1 <span class="gmail-Apple-converted-space"> </span>| 108</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_packets<span class="gmail-Apple-converted-space"> </span>| W#11-p2p1 <span class="gmail-Apple-converted-space"> </span>| 163892800</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_drops<span class="gmail-Apple-converted-space"> </span>| W#11-p2p1 <span class="gmail-Apple-converted-space"> </span>| 97865592</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_ifdrops<span class="gmail-Apple-converted-space"> </span>| W#11-p2p1 <span class="gmail-Apple-converted-space"> </span>| 108</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_packets<span class="gmail-Apple-converted-space"> </span>| W#12-p2p1 <span class="gmail-Apple-converted-space"> </span>| 195881047</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_drops<span class="gmail-Apple-converted-space"> </span>| W#12-p2p1 <span class="gmail-Apple-converted-space"> </span>| 97865592</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_ifdrops<span class="gmail-Apple-converted-space"> </span>| W#12-p2p1 <span class="gmail-Apple-converted-space"> </span>| 108</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_packets<span class="gmail-Apple-converted-space"> </span>| W#13-p2p1 <span class="gmail-Apple-converted-space"> </span>| 186604216</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_drops<span class="gmail-Apple-converted-space"> </span>| W#13-p2p1 <span class="gmail-Apple-converted-space"> </span>| 97865592</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_ifdrops<span class="gmail-Apple-converted-space"> </span>| W#13-p2p1 <span class="gmail-Apple-converted-space"> </span>| 108</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_packets<span class="gmail-Apple-converted-space"> </span>| W#14-p2p1 <span class="gmail-Apple-converted-space"> </span>| 167108752</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_drops<span class="gmail-Apple-converted-space"> </span>| W#14-p2p1 <span class="gmail-Apple-converted-space"> </span>| 97865592</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:13px;line-height:normal;font-family:Menlo;color:rgb(26,165,10);background-color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)"><b>capture.kernel</b></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures">_ifdrops<span class="gmail-Apple-converted-space"> </span>| W#14-p2p1 <span class="gmail-Apple-converted-space"> </span>| 108</span></p><div><br></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Jun 19, 2020 at 11:29 AM Edgmand, Craig <<a href="mailto:craig.edgmand@okstate.edu">craig.edgmand@okstate.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_6587982581223853492WordSection1">
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Hi Fatema,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">That’s interesting because the way I read it from this article<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><a href="https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Myricom" target="_blank">https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Myricom</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">You could set them on the command line like this…<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New"">SNF_NUM_RINGS=16 SNF_DATARING_SIZE=17179869184 SNF_DESCRING_SIZE=4294967296 SNF_FLAGS=0x1 suricata -c suricata.yaml -i eth5 --runmode=workers<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">I only use Myricom cards on my Zeek servers so I haven’t tested it and it has no such restrictions.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Good luck,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Craig<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<div>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif"> fatema bannatwala <<a href="mailto:fatema.bannatwala@gmail.com" target="_blank">fatema.bannatwala@gmail.com</a>>
<br>
<b>Sent:</b> Friday, June 19, 2020 1:16 PM<br>
<b>To:</b> Edgmand, Craig <<a href="mailto:craig.edgmand@okstate.edu" target="_blank">craig.edgmand@okstate.edu</a>><br>
<b>Cc:</b> Open Information Security Foundation <<a href="mailto:oisf-users@lists.openinfosecfoundation.org" target="_blank">oisf-users@lists.openinfosecfoundation.org</a>><br>
<b>Subject:</b> Re: [Oisf-users] Capture loss ~50% reported using Myricom with Suri v 5.0.2<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div style="border:1pt solid black;padding:2pt;max-width:90%">
<p class="MsoNormal" align="center" style="text-align:center;background:rgb(245,208,122)">
<strong><span style="color:rgb(127,22,6)">CAUTION:</span></strong><span style="color:black"> This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe
<u></u><u></u></span></p>
</div>
<div>
<div>
<p class="MsoNormal">Thanks Craig, I tried increasing SNF_DATARING_SIZE, but that variable gets overwritten and controlled by pcap.buffer-size in suricata.yml file which allows a max of 2gb, can't set more than that.
<u></u><u></u></p>
<div>
<p class="MsoNormal">Hence setting SNF_DATARING_SIZE explicitly has no effect since. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">This has been done:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9pt;font-family:Verdana,sans-serif;color:rgb(51,51,51)">The following pull request opened by Myricom in the libpcap project indicates that a future SNF software release could provide support for setting the SNF_DATARING_SIZE
via the pcap.buffer-size yaml setting:</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Ref: <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fthe-tcpdump-group%2Flibpcap%2Fpull%2F435&data=02%7C01%7Ccraig.edgmand%40okstate.edu%7Cd4444c14ab184963043408d8147cf441%7C2a69c91de8494e34a230cdf8b27e1964%7C0%7C0%7C637281874192318869&sdata=jhJDwiTawSglR4%2FOm33%2F685%2B2oXHYSnzu0ysXIj0%2BaE%3D&reserved=0" target="_blank"><span style="font-size:9pt;font-family:Verdana,sans-serif;color:rgb(198,26,26)">https://github.com/the-tcpdump-group/libpcap/pull/435</span></a><u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Fri, Jun 19, 2020 at 11:09 AM Edgmand, Craig <<a href="mailto:craig.edgmand@okstate.edu" target="_blank">craig.edgmand@okstate.edu</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Hi Fetema,</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Not an expert, but have you tried increasing these</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> </span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">SNF_DATARING_SIZE=4096MB</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">SNF_DESCRING_SIZE=1024MB</span></span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">If you have the memory, I would multiply these by a factor of 4. On my servers these numbers are huge.
Might also increase buffer size.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Thanks,</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Craig</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> </span><u></u><u></u></p>
<div>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif"> Oisf-users <<a href="mailto:oisf-users-bounces@lists.openinfosecfoundation.org" target="_blank">oisf-users-bounces@lists.openinfosecfoundation.org</a>>
<b>On Behalf Of </b>fatema bannatwala<br>
<b>Sent:</b> Friday, June 19, 2020 12:59 PM<br>
<b>To:</b> Open Information Security Foundation <<a href="mailto:oisf-users@lists.openinfosecfoundation.org" target="_blank">oisf-users@lists.openinfosecfoundation.org</a>><br>
<b>Subject:</b> [Oisf-users] Capture loss ~50% reported using Myricom with Suri v 5.0.2</span><u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
<div style="border:1pt solid black;padding:2pt;max-width:90%">
<p class="MsoNormal" align="center" style="text-align:center;background:rgb(245,208,122)">
<strong><span style="color:rgb(127,22,6)">CAUTION:</span></strong><span style="color:black"> This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe
</span><u></u><u></u></p>
</div>
<div>
<div>
<p class="MsoNormal">Hello Experts,
<u></u><u></u></p>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Need some help tuning down our prod suricata box running Suricata v 5.0.2 with Myricom NIC: 10G-PCIE-8B-S myri_snf 3.0.20.50894<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">It is consistently reporting ~50% capture loss, calculated based off of the capture.kernel_packets and capture.kernel_dropped values reported in stats.log file.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">I have followed the <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fblog.inliniac.net%2F2012%2F07%2F10%2Fsuricata-on-myricom-capture-cards%2F&data=02%7C01%7Ccraig.edgmand%40okstate.edu%7Cd4444c14ab184963043408d8147cf441%7C2a69c91de8494e34a230cdf8b27e1964%7C0%7C0%7C637281874192328864&sdata=5KgANusNnHK7cijv1B0rUDomBZaosOK8AuD9mTfd2Dg%3D&reserved=0" target="_blank">https://blog.inliniac.net/2012/07/10/suricata-on-myricom-capture-cards/</a><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">guide to pin the cpus to the worker nodes and use pcap.buffer_size to increase the SNF dataring size, but no effect..<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">We have one Myri card connected to p2p1 and two NUMA nodes, each with 8 cores (16 HT):<u></u><u></u></p>
</div>
<p class="MsoNormal">NUMA node0 CPU(s): 0-7,16-23<br>
NUMA node1 CPU(s): 8-15,24-31 <u></u><u></u></p>
<div>
<p class="MsoNormal">OS: Centos 7<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Any help in the right direction would be appreciated! :)<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Thanks!<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Fatema<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Following is settings from suricata.yml file<u></u><u></u></p>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"># Myricom support</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">pcap:</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">- interface: p2p1</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">threads: 14</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">buffer-size: 2gb</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">checksum-checks: no</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">pcap-file:</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"> </span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">checksum-checks:
auto</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin-right:0in;margin-bottom:12pt;margin-left:0in;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<u></u> <u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">threading:</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">set-cpu-affinity: yes</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">cpu-affinity:</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">- management-cpu-set:</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">cpu: [ "0" ]</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">mode: "balanced"</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">prio:</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">default: "low"</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">- worker-cpu-set:</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">cpu: [ "1-7","9-15" ]</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">mode: "exclusive"</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">prio:</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">default: "high"</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin-right:0in;margin-bottom:12pt;margin-left:0in;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<u></u> <u></u></p>
<p class="MsoNormal">Following is the currently recorded stats.log:<u></u><u></u></p>
</div>
<div>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">------------------------------------------------------------------------------------</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">Date: 6/19/2020 -- 10:55:36 (uptime: 0d, 04h 04m 10s)</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">------------------------------------------------------------------------------------</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">Counter
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">| TM Name
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">| Value</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">------------------------------------------------------------------------------------</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">capture.kernel_packets</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">| Total
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">| 28447139411</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">capture.kernel_drops</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">| Total
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">| 27910518132</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">capture.kernel_ifdrops</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">| Total
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">| 6034</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">decoder.pkts</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">| Total
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-apple-converted-space"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">
</span></span><span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">| 536633135</span></span><u></u><u></u></p>
</div>
<div>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"> </span><u></u><u></u></p>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<p class="MsoNormal">SNF parameters:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12pt"><u></u> <u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)">
<span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"> </span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">SNF_APP_ID=32</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">SNF_DATARING_SIZE=4096MB</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">SNF_DESCRING_SIZE=1024MB</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">SNF_NUM_RINGS=14</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">SNF_FLAGS=0x1</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p2" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);min-height:18px">
<span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"> </span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255)">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">LD_PRELOAD="/opt/snf/lib/libpcap.so.1"</span></span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p2" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);min-height:18px">
<span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)"> </span><u></u><u></u></p>
<p class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-p1" style="margin:0in 0in 0.0001pt;background:rgb(252,248,255);font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_6587982581223853492gmail-m7964226538806684005gmail-s1"><span style="font-size:11.5pt;font-family:Menlo,serif;color:rgb(101,13,108)">OPTIONS="--user suricata --group suricata --pcap"</span></span><u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</blockquote></div>