[Oisf-users] Packet Loss

[Victor Julien]

On 06/05/2014 08:53 PM, Cooper F. Nelson wrote:
> I'll second this.  Packet drops under 1% should be considered
> acceptable.
> 
> Isn't it also the case that packets could be dropped because they
> were broken in some way.  E.g., missing a fragment or failing a
> checksum?

Anything Suricata rejects won't be added to the kernel_drops counter.
Those will be in decoder.invalid.

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------