[Oisf-users] High packet loss with no rules

[Victor Julien]

On 01/17/2014 05:14 PM, Victor Julien wrote:
> On 01/17/2014 05:12 PM, Will Cladek wrote:
>>> Hi,
>>>
>>> I have two suggestions:
>>> 1) Please use http://pastebin.com/ for huge copy/pastes like this :)
>>> 2) This -
>>> www.pevma.blogspot.com/2013/12/suricata-and-grand-slam-of-open-source.html
>>>
>>> -  could prove a good starting point.
>>>
>>>
>>> thanks
>>>
>>
>> Thanks to all for the info.  It seems that running in AF_PACKET mode is
>> a good starting point, as using 1 thread seems to have dropped me down
>> to 10% packet loss.  However, when trying to increase the threads I get
>> the error:
>>
>> [ERRCODE: SC_ERR_AFP_CREATE(190)] - Coudn't set fanout mode, error
>> Protocol not available
>>
>> I see that kernel 3.2 is the minimum recommended in your tutorial, so
>> I'm guessing my Red Hat 6 box with kernel 2.6.32 is gonna be a non-starter?
> 
> PF_RING may still work on that.
> 

This guide should help with that. Just skip the CUDA portions:
https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Installation_with_CUDA_and_PFRING_on_Scientific_Linux_6

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------