[Oisf-users] max-pending-packets maxing out at 65,000

[Martin Holste]

Holy crap, 128 cores?  What is the architecture?

On Wed, Dec 14, 2011 at 1:24 AM, Victor Julien <victor at inliniac.net> wrote:
> On 12/10/2011 04:48 PM, Josh White wrote:
>> Victor,
>>
>> No reason, just curious. Planning on running a test on a 128 Core / 256GB
>> and try pushing things to the maximum limits.
>
> Thats a lot of cores :) What do the specs look like?
>
> Let me know if you need guidance/ideas to configure optimally for this.
>
> Cheers,
> Victor
>
>>
>> Thanks for the quick response!
>>
>> Josh
>>
>> On Sat, Dec 10, 2011 at 3:19 AM, Victor Julien <victor at inliniac.net> wrote:
>>
>>> On 12/10/2011 07:35 AM, Josh White wrote:
>>>> I appear to be hitting a ceiling of 65,000 packets when setting
>>>> max-pending-packets. If I set it to anything higher, even "66,000"
>>> Suricata
>>>> fails to start.
>>>>
>>>> ---
>>>> suricata -c /etc/suricata/suricata.yaml -i eth0
>>>> [3037] 10/12/2011 -- 01:29:11 - (suricata.c:649) <Info> (main) -- This is
>>>> Suricata version 1.1 (rev )
>>>> [3037] 10/12/2011 -- 01:29:11 - (util-cpu.c:171) <Info>
>>>> (UtilCpuPrintSummary) -- CPUs/cores online: 24
>>>> [3037] 10/12/2011 -- 01:29:11 - (util-ioctl.c:85) <Info> (GetIfaceMTU) --
>>>> Failure when trying to get MTU via ioctl: 19
>>>> [3037] 10/12/2011 -- 01:29:11 - (detect-pcre.c:128) <Info>
>>>> (DetectPcreRegister) -- Using PCRE match-limit setting of: 3500
>>>> [3037] 10/12/2011 -- 01:29:11 - (detect-pcre.c:138) <Info>
>>>> (DetectPcreRegister) -- Using PCRE match-limit-recursion setting of: 1500
>>>> ---
>>>>
>>>> Can anyone tell me why? Is this a hard set limit?
>>>
>>> Yeah it's a hard limit. Our packet pool is a lockless ringbuffer that
>>> can contain USHRT_MAX, so 65535 packets.
>>>
>>> Any reason to need more?
>>>
>>> --
>>> ---------------------------------------------
>>> Victor Julien
>>> http://www.inliniac.net/
>>> PGP: http://www.inliniac.net/victorjulien.asc
>>> ---------------------------------------------
>>>
>>> _______________________________________________
>>> Oisf-users mailing list
>>> Oisf-users at openinfosecfoundation.org
>>> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>>>
>>>
>>
>
>
> --
> ---------------------------------------------
> Victor Julien
> http://www.inliniac.net/
> PGP: http://www.inliniac.net/victorjulien.asc
> ---------------------------------------------
>
> _______________________________________________
> Oisf-users mailing list
> Oisf-users at openinfosecfoundation.org
> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users