[Oisf-users] Packet Loss

Victor Julien lists at inliniac.net
Thu Jun 5 21:02:55 UTC 2014

On 06/05/2014 08:53 PM, Cooper F. Nelson wrote:
> I'll second this.  Packet drops under 1% should be considered
> acceptable.
> Isn't it also the case that packets could be dropped because they
> were broken in some way.  E.g., missing a fragment or failing a
> checksum?

Anything Suricata rejects won't be added to the kernel_drops counter.
Those will be in decoder.invalid.

Victor Julien
PGP: http://www.inliniac.net/victorjulien.asc

More information about the Oisf-users mailing list