[Oisf-users] Kernel packets drops in AFpacket AUTO mode

[Victor Julien]

On 06/07/2013 02:24 PM, Fernando Sclavo wrote:
> Hi all.
> Trying to balance the load on all CPUs (and finally, reduce kernel
> dropped packets) we set Suricata from workers to auto mode. In this mode
> CPU consumption y 1/3 than in worker mode, but stats doesn't show
> packets drops anymore and couldn't see if there are dropped packets or not.
> How can we see packets drops in AFpacket AUTO mode?
> And another question: we see one Receive thread per NIC, and sometimes
> these threads goes to 100% CPU, is there any way to split them on more
> than one as we can do with detect threads?

You should be able to use the 'threads' option in the af-packet per nic
settings for this.

I don't recommend 'auto' mode. Autofp or workers is the way to go.

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------