[Oisf-users] Suricata load/latency spikes

[Oliver Humpage]

On 29 Jun 2015, at 16:03, Victor Julien <lists at inliniac.net> wrote:

> Enabling packet profiling (configure with --enable-profiling) gives you
> a break down of where suricata spends most time in the packet path,
> broken down by protocol.

Ah, good idea. I've set my router to grab a few thousand packets to a pcap file whenever ping latency goes up to over 100ms.

I guess I should install a profiling-enabled suricata on a different machine to analyse the files, so as not to let profiling affect the performance of the main router?

Oliver.