[Oisf-users] Kernel packets drops in AFpacket AUTO mode

[Fernando Sclavo]

Victor, threads are 16 in afpacket settings. Nevertheless, based on you
second comment, we will move to workers mode again.
Thanks


2013/6/7 Victor Julien <lists at inliniac.net>

> On 06/07/2013 02:24 PM, Fernando Sclavo wrote:
> > Hi all.
> > Trying to balance the load on all CPUs (and finally, reduce kernel
> > dropped packets) we set Suricata from workers to auto mode. In this mode
> > CPU consumption y 1/3 than in worker mode, but stats doesn't show
> > packets drops anymore and couldn't see if there are dropped packets or
> not.
> > How can we see packets drops in AFpacket AUTO mode?
> > And another question: we see one Receive thread per NIC, and sometimes
> > these threads goes to 100% CPU, is there any way to split them on more
> > than one as we can do with detect threads?
>
> You should be able to use the 'threads' option in the af-packet per nic
> settings for this.
>
> I don't recommend 'auto' mode. Autofp or workers is the way to go.
>
> --
> ---------------------------------------------
> Victor Julien
> http://www.inliniac.net/
> PGP: http://www.inliniac.net/victorjulien.asc
> ---------------------------------------------
>
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> OISF: http://www.openinfosecfoundation.org/
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20130607/71e5656e/attachment-0002.html>