[Oisf-users] tcp.segment_memcap_drop

[Peter Manev]

On Thu, Jun 5, 2014 at 9:31 PM, Kurzawa, Kevin
<kkurzawa at co.pinellas.fl.us> wrote:
> In general, is there a rule of thumb for the size that should be set for the stream memory cap for a certain amount of traffic?
> I.e.:
>   Stream memcap: 1gb per 1gb of traffic / 100% ram to traffic
>   Stream reassembly memcap: 2gb per 1gb of traffic / 200% ram to traffic

It depends on the type of traffic, it is really up to you.
The rule that I follow in general is - stream = x, reassembly = 2x

I think every case has its particularities  - the best would be to
tune Suri, then run it for a while and study carefully the
stats.log...then tune again if needed and so on.

thanks

-- 
Regards,
Peter Manev