[Oisf-users] Sudden packet loss on 2.0.7 and 2.0.8

[Peter Manev]

On Thu, May 7, 2015 at 10:29 PM, Yasha Zislin <coolyasha at hotmail.com> wrote:
> Before as of up to yesterday and this happens on both 2.0.7 and 2.0.8.

If that is not related to the Suricata versions - then it could likely
be connected to network traffic type change...somewhere in some
network segment.

Do you see any indication - ex. same traffic volume but much more pps
as compared to previous days...or bigger percentage of  TCP as
compared to previous days...any form of indication?

> It is possible it is something in my network but I dont see any indications.
> To my knowledge, typically when PF Ring slots run out, it is either a memory
> leak or buffer overflow or too many sessions to deal with.
>
>> Date: Thu, 7 May 2015 22:27:08 +0200
>> Subject: Re: [Oisf-users] Sudden packet loss on 2.0.7 and 2.0.8
>> From: petermanev at gmail.com
>> To: coolyasha at hotmail.com
>> CC: oisf-users at lists.openinfosecfoundation.org
>
>>
>> On Thu, May 7, 2015 at 10:20 PM, Yasha Zislin <coolyasha at hotmail.com>
>> wrote:
>> > Just noticed today that version 2.0.7 and 2.0.8 on my set up start
>> > getting
>> > huge packet loss after less than 24 hours of running. About 30% packet
>> > loss.
>> > It was averaging about 0.05% before.
>> > This was not happening before. Memory utilization is about 70% (of
>> > 140GB).
>>
>> Before - as in 2.0.7 ?
>>
>>
>> >
>> > PF Ring reports that it run out of "Free Num Slots" and I believe that's
>> > when packet loss starts to happen.
>> >
>> > Not sure how to troubleshoot this since stats.log dont show anything
>> > weird.
>> > Maybe PFRing slots buffer gets full but how do I check in Suricata what
>> > is
>> > filling it up?
>> >
>> > Any suggestions would be appreciated.
>> >
>> > Thank you.
>> >
>> >
>> > _______________________________________________
>> > Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
>> > Site: http://suricata-ids.org | Support:
>> > http://suricata-ids.org/support/
>> > List:
>> > https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>> > Suricata User Conference November 4 & 5 in Barcelona:
>> > http://oisfevents.net
>>
>>
>>
>> --
>> Regards,
>> Peter Manev



-- 
Regards,
Peter Manev