[Oisf-users] Packet Loss

[Cooper F. Nelson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Not sure if its an option, but you might want to consider doubling your
cores.  The published guides tend to use a 16 core system, but the
reality is that if you are really going for a multi-gigabit deployment
and zero packet drops you are going to need 32 cores at least.

On 6/4/2014 8:04 AM, Yasha Zislin wrote:
> To summarize my environment and set up.
> I have one server (16 CPU Cores, 132gb of ram) with two span ports which
> I monitor with PF_RING and Suricata 2.0.1.
> I've configured all of the buffers pretty high. When my suricata is
> running it is using almost 70 gigs of RAM.


- -- 
Cooper Nelson
Network Security Analyst
UCSD ACT Security Team
cnelson at ucsd.edu x41042
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (MingW32)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQEcBAEBAgAGBQJTj07DAAoJEKIFRYQsa8FWDNAH/1dGJ6iXhGtDGxCSDdSwT/NP
PrrF0AqJ8u97KJUZAIbVZOW5YZaFHGfW/HJuq8bpTokWEAYva7dfwIHG8MyfWT5A
9ED9aZvdU+aQ0vWEkPE6pAmNj8cbLHSsUPOM1vPYlCFbJmIP9DJGA6SwwnuWNn8h
ChAZR5lCxdRkIEhfNFg5/fiSwHuFPZCHTS8+Qt3IyLuToQbApG0UqBM5zkOrqJm7
DohucMg5L28hU+xDB3m2Jv1kR7wQ5icmCME+fxwKiPWZd+rVa/EDnemnfQpiigGx
eOBc2Tsw+sncfv5KIcKrC9zKu5RVrf3r4mJwt5hphG66y3RbWkKazbzT+jm9Pu8=
=FkAe
-----END PGP SIGNATURE-----