[Oisf-users] Packets errors

[Yasha Zislin]

I am using latest release of Suricata (2.0.6) to monitor two span ports on one server. I am using PF_RING with 20 detection threads for each SPAN port. I have finally tweaked my various memory buffers in suricata config to eliminate packet loss almost to zero. 
Recently I've noticed some strange info from running ifconfig. Both of my span ports report errors like theses:RX packets:561843496193 errors:3438084 dropped:0 overruns:3438082 frame:2
Not sure what the errors and overruns mean and how can I improve that?
The only thing I can think of is this: ethtool -C eth0 rx-usecs 500
That's what I am using. I was using a value of 1000 and changing to 500 seemed to make it better with packet loss. But setting it to 1 makes it worse.
Ideas?
Thank you. 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20150223/eb65f5f3/attachment.html>