[Oisf-users] max-pending-packets maxing out at 65,000

[Martin Holste]

OMG, I guess I should put that on my Amazon wishlist...

So how much traffic can you test against it?  I wonder if it could
handle 40 Gbit over bonded interfaces.

On Wed, Dec 14, 2011 at 9:54 AM, Peter Manev <petermanev at gmail.com> wrote:
> http://www-03.ibm.com/systems/power/hardware/795/specs.html
>
> looks cheap :)
>
>
> On Wed, Dec 14, 2011 at 4:48 PM, Josh White <josh at securemind.org> wrote:
>>
>> IBM Power 795
>> Power7 CPU(s) (4.25GHz with so called "Turbocore")
>>
>> Memory is a bit lacking compared to an Intel or a cheaper AMD Opteron
>>
>> "L2 256KB"
>> "L3 8MB"
>>
>> Still I'm anxious to see how it performs.
>>
>> Josh
>>
>>
>>
>> On Wed, Dec 14, 2011 at 10:15 AM, Will Metcalf <william.metcalf at gmail.com>
>> wrote:
>>>
>>> Josh will have to answer for sure but I did see this roaming around
>>> outside of his office building...
>>>
>>> http://yfrog.com/h3puwrp
>>>
>>> Regards,
>>>
>>> Will
>>> On Wed, Dec 14, 2011 at 8:33 AM, Martin Holste <mcholste at gmail.com>
>>> wrote:
>>> > Holy crap, 128 cores?  What is the architecture?
>>> >
>>> > On Wed, Dec 14, 2011 at 1:24 AM, Victor Julien <victor at inliniac.net>
>>> > wrote:
>>> >> On 12/10/2011 04:48 PM, Josh White wrote:
>>> >>> Victor,
>>> >>>
>>> >>> No reason, just curious. Planning on running a test on a 128 Core /
>>> >>> 256GB
>>> >>> and try pushing things to the maximum limits.
>>> >>
>>> >> Thats a lot of cores :) What do the specs look like?
>>> >>
>>> >> Let me know if you need guidance/ideas to configure optimally for
>>> >> this.
>>> >>
>>> >> Cheers,
>>> >> Victor
>>> >>
>>> >>>
>>> >>> Thanks for the quick response!
>>> >>>
>>> >>> Josh
>>> >>>
>>> >>> On Sat, Dec 10, 2011 at 3:19 AM, Victor Julien <victor at inliniac.net>
>>> >>> wrote:
>>> >>>
>>> >>>> On 12/10/2011 07:35 AM, Josh White wrote:
>>> >>>>> I appear to be hitting a ceiling of 65,000 packets when setting
>>> >>>>> max-pending-packets. If I set it to anything higher, even "66,000"
>>> >>>> Suricata
>>> >>>>> fails to start.
>>> >>>>>
>>> >>>>> ---
>>> >>>>> suricata -c /etc/suricata/suricata.yaml -i eth0
>>> >>>>> [3037] 10/12/2011 -- 01:29:11 - (suricata.c:649) <Info> (main) --
>>> >>>>> This is
>>> >>>>> Suricata version 1.1 (rev )
>>> >>>>> [3037] 10/12/2011 -- 01:29:11 - (util-cpu.c:171) <Info>
>>> >>>>> (UtilCpuPrintSummary) -- CPUs/cores online: 24
>>> >>>>> [3037] 10/12/2011 -- 01:29:11 - (util-ioctl.c:85) <Info>
>>> >>>>> (GetIfaceMTU) --
>>> >>>>> Failure when trying to get MTU via ioctl: 19
>>> >>>>> [3037] 10/12/2011 -- 01:29:11 - (detect-pcre.c:128) <Info>
>>> >>>>> (DetectPcreRegister) -- Using PCRE match-limit setting of: 3500
>>> >>>>> [3037] 10/12/2011 -- 01:29:11 - (detect-pcre.c:138) <Info>
>>> >>>>> (DetectPcreRegister) -- Using PCRE match-limit-recursion setting
>>> >>>>> of: 1500
>>> >>>>> ---
>>> >>>>>
>>> >>>>> Can anyone tell me why? Is this a hard set limit?
>>> >>>>
>>> >>>> Yeah it's a hard limit. Our packet pool is a lockless ringbuffer
>>> >>>> that
>>> >>>> can contain USHRT_MAX, so 65535 packets.
>>> >>>>
>>> >>>> Any reason to need more?
>>> >>>>
>>> >>>> --
>>> >>>> ---------------------------------------------
>>> >>>> Victor Julien
>>> >>>> http://www.inliniac.net/
>>> >>>> PGP: http://www.inliniac.net/victorjulien.asc
>>> >>>> ---------------------------------------------
>>> >>>>
>>> >>>> _______________________________________________
>>> >>>> Oisf-users mailing list
>>> >>>> Oisf-users at openinfosecfoundation.org
>>> >>>> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>>> >>>>
>>> >>>>
>>> >>>
>>> >>
>>> >>
>>> >> --
>>> >> ---------------------------------------------
>>> >> Victor Julien
>>> >> http://www.inliniac.net/
>>> >> PGP: http://www.inliniac.net/victorjulien.asc
>>> >> ---------------------------------------------
>>> >>
>>> >> _______________________________________________
>>> >> Oisf-users mailing list
>>> >> Oisf-users at openinfosecfoundation.org
>>> >> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>>> > _______________________________________________
>>> > Oisf-users mailing list
>>> > Oisf-users at openinfosecfoundation.org
>>> > http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>>> _______________________________________________
>>> Oisf-users mailing list
>>> Oisf-users at openinfosecfoundation.org
>>> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>>>
>>
>>
>> _______________________________________________
>> Oisf-users mailing list
>> Oisf-users at openinfosecfoundation.org
>> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>>
>
>
>
> --
> Peter Manev
>
> _______________________________________________
> Oisf-users mailing list
> Oisf-users at openinfosecfoundation.org
> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>