[Oisf-users] max-pending-packets maxing out at 65,000

[Will Metcalf]

Josh will have to answer for sure but I did see this roaming around
outside of his office building...

http://yfrog.com/h3puwrp

Regards,

Will
On Wed, Dec 14, 2011 at 8:33 AM, Martin Holste <mcholste at gmail.com> wrote:
> Holy crap, 128 cores?  What is the architecture?
>
> On Wed, Dec 14, 2011 at 1:24 AM, Victor Julien <victor at inliniac.net> wrote:
>> On 12/10/2011 04:48 PM, Josh White wrote:
>>> Victor,
>>>
>>> No reason, just curious. Planning on running a test on a 128 Core / 256GB
>>> and try pushing things to the maximum limits.
>>
>> Thats a lot of cores :) What do the specs look like?
>>
>> Let me know if you need guidance/ideas to configure optimally for this.
>>
>> Cheers,
>> Victor
>>
>>>
>>> Thanks for the quick response!
>>>
>>> Josh
>>>
>>> On Sat, Dec 10, 2011 at 3:19 AM, Victor Julien <victor at inliniac.net> wrote:
>>>
>>>> On 12/10/2011 07:35 AM, Josh White wrote:
>>>>> I appear to be hitting a ceiling of 65,000 packets when setting
>>>>> max-pending-packets. If I set it to anything higher, even "66,000"
>>>> Suricata
>>>>> fails to start.
>>>>>
>>>>> ---
>>>>> suricata -c /etc/suricata/suricata.yaml -i eth0
>>>>> [3037] 10/12/2011 -- 01:29:11 - (suricata.c:649) <Info> (main) -- This is
>>>>> Suricata version 1.1 (rev )
>>>>> [3037] 10/12/2011 -- 01:29:11 - (util-cpu.c:171) <Info>
>>>>> (UtilCpuPrintSummary) -- CPUs/cores online: 24
>>>>> [3037] 10/12/2011 -- 01:29:11 - (util-ioctl.c:85) <Info> (GetIfaceMTU) --
>>>>> Failure when trying to get MTU via ioctl: 19
>>>>> [3037] 10/12/2011 -- 01:29:11 - (detect-pcre.c:128) <Info>
>>>>> (DetectPcreRegister) -- Using PCRE match-limit setting of: 3500
>>>>> [3037] 10/12/2011 -- 01:29:11 - (detect-pcre.c:138) <Info>
>>>>> (DetectPcreRegister) -- Using PCRE match-limit-recursion setting of: 1500
>>>>> ---
>>>>>
>>>>> Can anyone tell me why? Is this a hard set limit?
>>>>
>>>> Yeah it's a hard limit. Our packet pool is a lockless ringbuffer that
>>>> can contain USHRT_MAX, so 65535 packets.
>>>>
>>>> Any reason to need more?
>>>>
>>>> --
>>>> ---------------------------------------------
>>>> Victor Julien
>>>> http://www.inliniac.net/
>>>> PGP: http://www.inliniac.net/victorjulien.asc
>>>> ---------------------------------------------
>>>>
>>>> _______________________________________________
>>>> Oisf-users mailing list
>>>> Oisf-users at openinfosecfoundation.org
>>>> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>>>>
>>>>
>>>
>>
>>
>> --
>> ---------------------------------------------
>> Victor Julien
>> http://www.inliniac.net/
>> PGP: http://www.inliniac.net/victorjulien.asc
>> ---------------------------------------------
>>
>> _______________________________________________
>> Oisf-users mailing list
>> Oisf-users at openinfosecfoundation.org
>> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> _______________________________________________
> Oisf-users mailing list
> Oisf-users at openinfosecfoundation.org
> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users