[Oisf-users] max-pending-packets maxing out at 65,000

[Josh White]

IBM Power 795
Power7 CPU(s) (4.25GHz with so called "Turbocore")

Memory is a bit lacking compared to an Intel or a cheaper AMD Opteron

"L2 256KB"
"L3 8MB"

Still I'm anxious to see how it performs.

Josh


On Wed, Dec 14, 2011 at 10:15 AM, Will Metcalf <william.metcalf at gmail.com>wrote:

> Josh will have to answer for sure but I did see this roaming around
> outside of his office building...
>
> http://yfrog.com/h3puwrp
>
> Regards,
>
> Will
> On Wed, Dec 14, 2011 at 8:33 AM, Martin Holste <mcholste at gmail.com> wrote:
> > Holy crap, 128 cores?  What is the architecture?
> >
> > On Wed, Dec 14, 2011 at 1:24 AM, Victor Julien <victor at inliniac.net>
> wrote:
> >> On 12/10/2011 04:48 PM, Josh White wrote:
> >>> Victor,
> >>>
> >>> No reason, just curious. Planning on running a test on a 128 Core /
> 256GB
> >>> and try pushing things to the maximum limits.
> >>
> >> Thats a lot of cores :) What do the specs look like?
> >>
> >> Let me know if you need guidance/ideas to configure optimally for this.
> >>
> >> Cheers,
> >> Victor
> >>
> >>>
> >>> Thanks for the quick response!
> >>>
> >>> Josh
> >>>
> >>> On Sat, Dec 10, 2011 at 3:19 AM, Victor Julien <victor at inliniac.net>
> wrote:
> >>>
> >>>> On 12/10/2011 07:35 AM, Josh White wrote:
> >>>>> I appear to be hitting a ceiling of 65,000 packets when setting
> >>>>> max-pending-packets. If I set it to anything higher, even "66,000"
> >>>> Suricata
> >>>>> fails to start.
> >>>>>
> >>>>> ---
> >>>>> suricata -c /etc/suricata/suricata.yaml -i eth0
> >>>>> [3037] 10/12/2011 -- 01:29:11 - (suricata.c:649) <Info> (main) --
> This is
> >>>>> Suricata version 1.1 (rev )
> >>>>> [3037] 10/12/2011 -- 01:29:11 - (util-cpu.c:171) <Info>
> >>>>> (UtilCpuPrintSummary) -- CPUs/cores online: 24
> >>>>> [3037] 10/12/2011 -- 01:29:11 - (util-ioctl.c:85) <Info>
> (GetIfaceMTU) --
> >>>>> Failure when trying to get MTU via ioctl: 19
> >>>>> [3037] 10/12/2011 -- 01:29:11 - (detect-pcre.c:128) <Info>
> >>>>> (DetectPcreRegister) -- Using PCRE match-limit setting of: 3500
> >>>>> [3037] 10/12/2011 -- 01:29:11 - (detect-pcre.c:138) <Info>
> >>>>> (DetectPcreRegister) -- Using PCRE match-limit-recursion setting of:
> 1500
> >>>>> ---
> >>>>>
> >>>>> Can anyone tell me why? Is this a hard set limit?
> >>>>
> >>>> Yeah it's a hard limit. Our packet pool is a lockless ringbuffer that
> >>>> can contain USHRT_MAX, so 65535 packets.
> >>>>
> >>>> Any reason to need more?
> >>>>
> >>>> --
> >>>> ---------------------------------------------
> >>>> Victor Julien
> >>>> http://www.inliniac.net/
> >>>> PGP: http://www.inliniac.net/victorjulien.asc
> >>>> ---------------------------------------------
> >>>>
> >>>> _______________________________________________
> >>>> Oisf-users mailing list
> >>>> Oisf-users at openinfosecfoundation.org
> >>>> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> >>>>
> >>>>
> >>>
> >>
> >>
> >> --
> >> ---------------------------------------------
> >> Victor Julien
> >> http://www.inliniac.net/
> >> PGP: http://www.inliniac.net/victorjulien.asc
> >> ---------------------------------------------
> >>
> >> _______________________________________________
> >> Oisf-users mailing list
> >> Oisf-users at openinfosecfoundation.org
> >> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> > _______________________________________________
> > Oisf-users mailing list
> > Oisf-users at openinfosecfoundation.org
> > http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> _______________________________________________
> Oisf-users mailing list
> Oisf-users at openinfosecfoundation.org
> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20111214/16a1be2a/attachment-0002.html>