[Oisf-users] Kernel packets drops in AFpacket AUTO mode

[Listman]

Can you post your configuration?  Are you using a 64bit system?


ZK


On Jun 7, 2013, at 8:48 AM, Fernando Sclavo <fsclavo at gmail.com> wrote:

> Victor, threads are 16 in afpacket settings. Nevertheless, based on you second comment, we will move to workers mode again.
> Thanks
> 
> 
> 2013/6/7 Victor Julien <lists at inliniac.net>
> On 06/07/2013 02:24 PM, Fernando Sclavo wrote:
> > Hi all.
> > Trying to balance the load on all CPUs (and finally, reduce kernel
> > dropped packets) we set Suricata from workers to auto mode. In this mode
> > CPU consumption y 1/3 than in worker mode, but stats doesn't show
> > packets drops anymore and couldn't see if there are dropped packets or not.
> > How can we see packets drops in AFpacket AUTO mode?
> > And another question: we see one Receive thread per NIC, and sometimes
> > these threads goes to 100% CPU, is there any way to split them on more
> > than one as we can do with detect threads?
> 
> You should be able to use the 'threads' option in the af-packet per nic
> settings for this.
> 
> I don't recommend 'auto' mode. Autofp or workers is the way to go.
> 
> --
> ---------------------------------------------
> Victor Julien
> http://www.inliniac.net/
> PGP: http://www.inliniac.net/victorjulien.asc
> ---------------------------------------------
> 
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> OISF: http://www.openinfosecfoundation.org/
> 
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> OISF: http://www.openinfosecfoundation.org/

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20130607/965fd76d/attachment-0002.html>