[Oisf-users] Percentage of dropped packets

[Victor Julien]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 05/30/2012 12:40 PM, Peter Bates wrote:
> 
> Hello again all
> 
> Date: 5/30/2012 -- 11:31:44 (uptime: 0d, 00h 05m 38s) 
> tcp.invalid_checksum      | AFPacketeth61             | 262 
> tcp.reassembly_gap        | AFPacketeth61             | 1502 Date:
> 5/30/2012 -- 11:32:05 (uptime: 0d, 00h 05m 59s) 
> tcp.invalid_checksum      | AFPacketeth61             | 272 
> tcp.reassembly_gap        | AFPacketeth61             | 1600 Date:
> 5/30/2012 -- 11:32:33 (uptime: 0d, 00h 06m 27s) 
> tcp.invalid_checksum      | AFPacketeth61             | 294 
> tcp.reassembly_gap        | AFPacketeth61             | 1738
> 
> [27083] 30/5/2012 -- 11:26:10 - (tm-threads.c:1858) <Info> 
> (TmThreadWaitOnThreadInit) -- all 1 packet processing threads, 3 
> management threads initialized, engine started. [27083] 30/5/2012
> -- 11:36:42 - (suricata.c:1781) <Info> (main) -- stopping engine,
> waiting for outstanding packets [27083] 30/5/2012 -- 11:36:42 -
> (suricata.c:1816) <Info> (main) -- all packets processed by
> threads, stopping engine [27086] 30/5/2012 -- 11:36:42 -
> (flow-manager.c:542) <Info> (FlowManagerThread) -- 0 new flows, 0
> established flows were timed out, 0 flows in closed state [27083]
> 30/5/2012 -- 11:36:44 - (suricata.c:1845) <Info> (main) -- time
> elapsed 633.755s [27085] 30/5/2012 -- 11:36:44 -
> (source-af-packet.c:965) <Info> (ReceiveAFPThreadExitStats) --
> (AFPacketeth61) Kernel: Packets 141765482, dropped 114700625
> 
> Would kernel 3.x and FANOUT with AF_PACKET help here?
> 
> I'm just considering my options before I dive in with PF_RING
> because I was trying to keep things simple.

Yeah, that setup works out of the box on Fedora 16 for example.
Including the zero copy support.

- -- 
- ---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
- ---------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk/HXOMACgkQiSMBBAuniMew2ACdHi6k9mgiIj236RlrHb9fHEfz
WZ8AnjsQ7sKsmQR6/eHueAa1M6Jkz+fy
=BXdU
-----END PGP SIGNATURE-----