[Oisf-users] Packets errors

[Peter Manev]

On 02/23/2015 02:54 PM, Yasha Zislin wrote:
> I am using latest release of Suricata (2.0.6) to monitor two span ports on one server. I am using PF_RING with 20 detection threads for each SPAN port. I have finally tweaked my various memory buffers in suricata config to eliminate packet loss almost to zero. 
> Recently I've noticed some strange info from running ifconfig. Both of my span ports report errors like theses:RX packets:561843496193 errors:3438084 dropped:0 overruns:3438082 frame:2

>From the info provided - errors are 0.00061% of packets - is it really
that critical in your case?


> Not sure what the errors and overruns mean and how can I improve that?

http://www.tldp.org/LDP/nag2/x-087-2-iface.ifconfig.html

> The only thing I can think of is this: ethtool -C eth0 rx-usecs 500
> That's what I am using. I was using a value of 1000 and changing to 500 seemed to make it better with packet loss. But setting it to 1 makes it worse.
> Ideas?
> Thank you. 		 	   		  
> 
> 
> 
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> Training now available: http://suricata-ids.org/training/
> 

-- 

Regards,
Peter Manev