[Oisf-users] Sudden packet loss on 2.0.7 and 2.0.8

[Yasha Zislin]

Before as of up to yesterday and this happens on both 2.0.7 and 2.0.8. It is possible it is something in my network but I dont see any indications. To my knowledge, typically when PF Ring slots run out, it is either a memory leak or buffer overflow or too many sessions to deal with.

> Date: Thu, 7 May 2015 22:27:08 +0200
> Subject: Re: [Oisf-users] Sudden packet loss on 2.0.7 and 2.0.8
> From: petermanev at gmail.com
> To: coolyasha at hotmail.com
> CC: oisf-users at lists.openinfosecfoundation.org
> 
> On Thu, May 7, 2015 at 10:20 PM, Yasha Zislin <coolyasha at hotmail.com> wrote:
> > Just noticed today that version 2.0.7 and 2.0.8 on my set up start getting
> > huge packet loss after less than 24 hours of running. About 30% packet loss.
> > It was averaging about 0.05% before.
> > This was not happening before. Memory utilization is about 70% (of 140GB).
> 
> Before - as in 2.0.7 ?
> 
> 
> >
> > PF Ring reports that it run out of "Free Num Slots" and I believe that's
> > when packet loss starts to happen.
> >
> > Not sure how to troubleshoot this since stats.log dont show anything weird.
> > Maybe PFRing slots buffer gets full but how do I check in Suricata what is
> > filling it up?
> >
> > Any suggestions would be appreciated.
> >
> > Thank you.
> >
> >
> > _______________________________________________
> > Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> > Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> > List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> > Suricata User Conference November 4 & 5 in Barcelona: http://oisfevents.net
> 
> 
> 
> -- 
> Regards,
> Peter Manev
 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20150507/56db15f3/attachment-0002.html>