[Oisf-users] High packet loss with no rules

[Victor Julien]

On 01/17/2014 05:12 PM, Will Cladek wrote:
>> Hi,
>>
>> I have two suggestions:
>> 1) Please use http://pastebin.com/ for huge copy/pastes like this :)
>> 2) This -
>> www.pevma.blogspot.com/2013/12/suricata-and-grand-slam-of-open-source.html
>>
>> -  could prove a good starting point.
>>
>>
>> thanks
>>
> 
> Thanks to all for the info.  It seems that running in AF_PACKET mode is
> a good starting point, as using 1 thread seems to have dropped me down
> to 10% packet loss.  However, when trying to increase the threads I get
> the error:
> 
> [ERRCODE: SC_ERR_AFP_CREATE(190)] - Coudn't set fanout mode, error
> Protocol not available
> 
> I see that kernel 3.2 is the minimum recommended in your tutorial, so
> I'm guessing my Red Hat 6 box with kernel 2.6.32 is gonna be a non-starter?

PF_RING may still work on that.

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------