[Oisf-users] Suricata load/latency spikes

Cooper F. Nelson cnelson at ucsd.edu
Mon Jun 29 17:36:27 UTC 2015

Hash: SHA1

Last year I traced down intermittent performance issues w/suricata to
compromised local clients that were participating in a DDOS botnet.
They would periodically SYN flood remote hosts, which would crush the
suricata process as it tried to track millions of new flows in a few

They way I found this was I wrote a simple shell script to display top
talkers by IP, which I ran when suricata was under heavy load and
falling over.  I've since created some signatures to look for SYN floods.

In your environment, you could do something similar with argus, netflow
or ntop and see what the top talkers are during your periods of outages.

Re: the DNS issues, I've also seen performance issues due to clients
running bitorrent over port 53.

- -Coop

On 6/29/2015 8:01 AM, Oliver Humpage wrote:
> On 29 Jun 2015, at 14:37, robert.jamison at bt.com wrote:
>> The only non-trivial difference in the before and after stats is
>> that dns.memuse increases by a factor of 3x.
> That's pretty much what I thought too. But it's still only a tiny
> amount, so probably not the issue.
> I've been using systat to look at PPS, and although sometimes I can
> see latency increase with PPS, at other times I can see PPS get to
> nearly 10x above the background average and no ill effects (4k as
> opposed to normal 0.5k). So it's not purely PPS, and it's not
> anything stats.log can point at.
> I might start commenting out rulesets one at a time to see if any
> particular sets are causing issues.
> If anyone else has any ideas, do shout :)
> Thanks,
> Oliver. _______________________________________________ Suricata IDS
> Users mailing list: oisf-users at openinfosecfoundation.org Site:
> http://suricata-ids.org | Support: http://suricata-ids.org/support/ 
> List:
> https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users 
> Suricata User Conference November 4 & 5 in Barcelona:
> http://oisfevents.net

- -- 
Cooper Nelson
Network Security Analyst
UCSD ACT Security Team
cnelson at ucsd.edu x41042
Version: GnuPG v2.0.17 (MingW32)


More information about the Oisf-users mailing list