[Oisf-users] unusual packet loss

[Yasha Zislin]

I am running Suricata 2.1beta4 with PF_RING.I have 4 threads (4 logical CPUs) monitoring one interface. After a few minutes of running, I get 50% packet loss.I have tweaked all of the stream reassembly buffers to avoid packet loss. Only one of the threads gets kernel packet drops. I've noticed that one CPU is running at 100% and others are almost idle. Looking at stats.log, that one thread for some reason is digesting more packets than others.Throughput on this sensor is not that big. About 500k packets a minute. I use this image on other sensors without issues. 
Need help to figure out why only one thread is doing MOST of the work.
Thank you. 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20151223/5078d4a0/attachment.html>