[Oisf-users] Suricata load/latency spikes

[Peter Manev]

> On 29 jun 2015, at 18:04, Oliver Humpage <oliver at watershed.co.uk> wrote:
> 
> 
>> On 29 Jun 2015, at 16:03, Victor Julien <lists at inliniac.net> wrote:
>> 
>> Enabling packet profiling (configure with --enable-profiling) gives you
>> a break down of where suricata spends most time in the packet path,
>> broken down by protocol.
> 
> Ah, good idea. I've set my router to grab a few thousand packets to a pcap file whenever ping latency goes up to over 100ms.
> 
> I guess I should install a profiling-enabled suricata on a different machine to analyse the files, so as not to let profiling affect the performance of the main router?

Highly advisable indeed(at least as a first step) since the profiling affects performance - but not sure if reading a pcap can pinpoint the issue you are experiencing 100%.

> 
> Oliver.
> 
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> Suricata User Conference November 4 & 5 in Barcelona: http://oisfevents.net