[Oisf-users] Suricata IPS settings for MTU size of 16110

[Peter Manev]

No other that i can think of, that would be of an issue here.

If you specify another value for the "default-packet-size " , would you
still have drops? ( out of curiousity )
if you start Suri with the same size of pkts in the yaml - would you still
have drops? ...
just trying to see if it is working in one case but not another - might be
a value/bug issue?

thanks

On Thu, Dec 29, 2011 at 4:07 PM, Hariharan Thantry <thantry at gmail.com>wrote:

> Yes, the MTU is 16110. 18 bytes are for additional ethernet headers.
> This is the maximum allowable MTU for the Intel 82599 10G NIC.
>
> http://downloadmirror.intel.com/14687/eng/README.txt
>
>
> Thanks,
> Hari
>
> On Thu, Dec 29, 2011 at 10:12 AM, Peter Manev <petermanev at gmail.com>
> wrote:
> > Hi,
> >
> > I migh have misunderstood ... but the MTU default 16128? - you are saying
> > that you have reconfigured the default MTU size (of a linux machine for
> > example) from 1500 bytes (default) to 16128 ?
> >
> > thanks
> >
> > On Wed, Dec 28, 2011 at 7:16 PM, Hariharan Thantry <thantry at gmail.com>
> > wrote:
> >>
> >> Hi,
> >>
> >> Are there any config settings in suricata.yaml when the MTU size has
> >> been configured to 16110 (other than default-packet-size of 16128).
> >> Suricata's (latest  not getting any packets from iptables with this
> >> MTU size, and am wondering if the packets are getting dropped somehow.
> >> A simple pthread based NFQUEUE handler works for the same MTU size, so
> >> it's not a low level networking issue.
> >> I'm using the latest Suricata release 1.2beta1, with the --worker
> >> option, and queue-balancing across the eight hyper threads that my
> >> machine has.
> >>
> >> Thanks,
> >> Hari
> >> _______________________________________________
> >> Oisf-users mailing list
> >> Oisf-users at openinfosecfoundation.org
> >> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> >
> >
> >
> >
> > --
> > Peter Manev
>



-- 
Peter Manev
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20120103/e2c9e466/attachment-0002.html>