[Oisf-users] HTTP Sessions and resource estimation

[Cooper F. Nelson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I think that is too high a stream reassembly depth.  Try 1mb instead.

On 3/19/2015 7:19 AM, Yasha Zislin wrote:
> 
> My stream reassembly depth is set to 20mb. I forget why it is so high,
> but I've made it to minimize packet loss.
> 
> I am monitoring two span ports (about 1gig each) and my 40 logical
> CPUs/140 gigs of RAM server is using 95% of RAM.
> I thought Suricata was able to handle 10 gig feeds. Just trying to
> understand what I am doing wrong.
> 
> Thanks.
> 


- -- 
Cooper Nelson
Network Security Analyst
UCSD ACT Security Team
cnelson at ucsd.edu x41042
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (MingW32)

iQEcBAEBAgAGBQJVCvlYAAoJEKIFRYQsa8FWfkEH/A5wcqI4JLfh1z6G9cZZurQ2
logjLwur4bMJgFi5VurAV9+PeyGv7Sqc4fd82CvYZbznhxQ93hGEYS1ObnhYaGRt
woMTGYbbGs+9tTAb0nhZ9g2LsvosFJnjkW34TmAblgedEGEkSYtm0s5yN5H33RyB
32T4J/ivwV07d6GmgHugpKFEaNJq/nJXkUFrRzIKI9/sRiD68yUjqX0+5Gt4F74P
1d6uVcRW630KtHFsHwVmbZ3wTuGovgFPCt/NfunVPPp+f/RB7G/LRFhxJaEUp9Ee
USR+4f2lG3SR2M6AM4lHnw0RFcQJSJ4IugrOZrUzwKUww/7C/01vYsOmbzJJLlw=
=Y+55
-----END PGP SIGNATURE-----