[Oisf-users] Tuning Suricata (2.0beta1) -- no rules and lots of packet loss

Duarte Silva duarte.silva at serializing.me
Wed Aug 21 20:52:24 UTC 2013

Tritium, are you using worker mode? If so, could yoy copy and paste the
suricata.yaml configuration for the CPU affinity?

Plus, just to be sure, you have two network cards with two ports, each one
using 16 queues for a total of 48 queues correct?
 Yes.  Those interrupts are cleared when the kernel module is loaded.  As I
explained what you are looking at is before the queues are mapped using
set_irq_affinity but with irqbalance already killed.


Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
OISF: http://www.openinfosecfoundation.org/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20130821/e7fcc9fc/attachment-0002.html>

More information about the Oisf-users mailing list