[Oisf-users] Questions about stats and packet drops

[Jose Vila]

Thanks for your reply Victor.

I have 12GB of RAM, and htop reports on Suricata process 8559MB of Virtual
Memory usage, 7608MB of resources and 1171MB of shared memory, for a total
of 8012MB of RAM consumed.

I guess it may have something to do with issue 1178: as Ken Steele says the
value doesn't get reduced when flows expire and the value starts growing
until counter limit.

Is there anything I can do to provide more information to help you
debugging?

Regards,

Jose Vila.



On Wed, Jan 7, 2015 at 5:19 PM, Victor Julien <lists at inliniac.net> wrote:

> On 01/07/2015 05:14 PM, Jose Vila wrote:
> > I'm using PF_RING and getting this values for tcp.reassembly_memuse
> > right now:
> > tcp.reassembly_memuse     | RxPFRbond01               |
> 18446744073431298171
> > tcp.reassembly_memuse     | RxPFRbond02               |
> 18446744073431298171
> > tcp.reassembly_memuse     | RxPFRbond03               |
> 18446744073431298171
> > tcp.reassembly_memuse     | RxPFRbond04               |
> 18446744073431298171
> > tcp.reassembly_memuse     | RxPFRbond05               |
> 18446744073431298171
> > tcp.reassembly_memuse     | RxPFRbond06               |
> 18446744073431298171
> > tcp.reassembly_memuse     | RxPFRbond07               |
> 18446744073431298171
> > tcp.reassembly_memuse     | RxPFRbond08               |
> 18446744073431298171
> > tcp.reassembly_memuse     | RxPFRbond09               |
> 18446744073431298171
>
> Could be related to:
> https://redmine.openinfosecfoundation.org/issues/1178
> https://redmine.openinfosecfoundation.org/issues/632
>
> Although, you'd need a lot of memory use to overflow a 64bit counter. So
> perhaps something else is happening as well.
>
> --
> ---------------------------------------------
> Victor Julien
> http://www.inliniac.net/
> PGP: http://www.inliniac.net/victorjulien.asc
> ---------------------------------------------
>
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> Training now available: http://suricata-ids.org/training/
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20150107/11a826d1/attachment-0002.html>