[Oisf-users] Packet drops on core 0 when file extraction is enabled?

[Cooper F. Nelson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi all,

I'm experimenting with file extraction again.

It's working well with the exception that core 0 is dropping lots of
packets (using worker mode).  I have management threads set to use all
cores, low priority.  Is there any setting available to mitigate this?
It seems as if some of the file tracking is single-threaded, or
otherwise tied to core 0.  Example below; with file tracking disabled
packet loss is the same for all cores.

> capture.kernel_packets    | AFPacketeth21             | 34950994
> capture.kernel_drops      | AFPacketeth21             | 11398893
> capture.kernel_packets    | AFPacketeth22             | 39400674
> capture.kernel_drops      | AFPacketeth22             | 63314
> capture.kernel_packets    | AFPacketeth23             | 34777034
> capture.kernel_drops      | AFPacketeth23             | 55394
> capture.kernel_packets    | AFPacketeth24             | 41194138
> capture.kernel_drops      | AFPacketeth24             | 223780
> capture.kernel_packets    | AFPacketeth25             | 34955741
> capture.kernel_drops      | AFPacketeth25             | 73299
> capture.kernel_packets    | AFPacketeth26             | 37768280
> capture.kernel_drops      | AFPacketeth26             | 64416
> capture.kernel_packets    | AFPacketeth27             | 37295553
> capture.kernel_drops      | AFPacketeth27             | 67338
> capture.kernel_packets    | AFPacketeth28             | 40437294
> capture.kernel_drops      | AFPacketeth28             | 206237
> capture.kernel_packets    | AFPacketeth29             | 38204625
> capture.kernel_drops      | AFPacketeth29             | 67937
> capture.kernel_packets    | AFPacketeth210            | 34698712
> capture.kernel_drops      | AFPacketeth210            | 62158
> capture.kernel_packets    | AFPacketeth211            | 38141402
> capture.kernel_drops      | AFPacketeth211            | 59317
> capture.kernel_packets    | AFPacketeth212            | 35530841
> capture.kernel_drops      | AFPacketeth212            | 53819
> capture.kernel_packets    | AFPacketeth213            | 40857479
> capture.kernel_drops      | AFPacketeth213            | 353060
> capture.kernel_packets    | AFPacketeth214            | 38171288
> capture.kernel_drops      | AFPacketeth214            | 57635
> capture.kernel_packets    | AFPacketeth215            | 36431721
> capture.kernel_drops      | AFPacketeth215            | 46113
> capture.kernel_packets    | AFPacketeth216            | 40470757
> capture.kernel_drops      | AFPacketeth216            | 200730


- -- 
Cooper Nelson
Network Security Analyst
UCSD ACT Security Team
cnelson at ucsd.edu x41042
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (MingW32)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQEcBAEBAgAGBQJS6rK5AAoJEKIFRYQsa8FWHiwIAI7flLystD64786wDi1SyMzF
UL49yb/j6P+eS2Wp9ZxBZLXB00fPr73i3HzoAG0xI/75Ph6trTAwRVVBghxgwXMP
I2MQYi/1yrAWEb8EechS/mHUbXGO08dftXylh1sQZ/8oerJ7j3ILwF6kNjqsNFMl
oVOxL0MY5vwOpN6MI5Hx0WVo2JF30Ka9E7rH/uq+zd1BgOGx3sUXkh0InJTTBvYK
6iz0BYy4zY6yqj+ovuy5wa6Vf6BnNikk4LB+gtfSii0+oa94s79KheAoAmxShZht
0SP9TqUtIDQgQ/V2GhaCkgas0Vz76jBB5qiHZitivRWLjiGO2ql7U6jVDiG6llE=
=JiHT
-----END PGP SIGNATURE-----