[Oisf-users] What does it means??

[Peter Manev]

>>>
>>> Nop, offloading is disbled:
>>>
>>> em4: flags=48943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST,MONITOR>
>>> metric 0 mtu 1514
>>>     options=20d8<VLAN_MTU,VLAN_HWTAGGING,POLLING,VLAN_HWCSUM,WOL_MAGIC>
>>>     ether 52:54:00:44:f9:ee
>>>     inet6 fe80::5054:ff:fe44:f9ee%em4 prefixlen 64 scopeid 0x5
>>>     nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
>>>     media: Ethernet autoselect (1000baseT <full-duplex>)
>>>     status: active
>>>
>>>
>>>> Do you have TCP checksums enabled in yaml?
>>>
>>> Nop, as you suggested some time ago :).
>>
>> aha :)
>> So (if I remember correctly) - some time ago we managed to fix this
>> issue with the drops. So what happened in between :) ?
>>
>
> This is a different host monitoring different network, and with
> different problems :)) ... Previous installation goes well after some
> tunning in SPAN port configuration .... But I use this previous
> suricata.yaml config as base for this installation ...

And does this installation need  some tuning in SPAN port
configuration a well ? or you are past that stage?


-- 
Regards,
Peter Manev