[Oisf-users] af-packet and Linux Kernel version

[Cooper F. Nelson]

Hi Eric and Peter!

Great meeting everyone @Suricon, I had an awesome time.

I've been reviewing our build here and can confirm we are still seeing
the ixgbe asymmetric hashing issue even on a very recent kernel/driver
(4.8.7).  I think what happened was that when I was doing my testing
with the newer kernels I was only monitoring a single host, so the
timing issues with asymmetric hashing on the NIC itself did not cause an
issue.  Under load it's still a problem, however.

I've tried using a single RSS queue tied to one core as mentioned in
your link, however on our system (2.8 Ghz Xeon) the core is pegged at
100% and we are seeing over 50% packet drops.  Is there a published
tuning guide, including kernel and NIC/ethtool settings, for this
configuration?

-Coop

On 11/14/2016 3:24 PM, Eric Leblond wrote:
> I meant 
> 
> http://suricata.readthedocs.io/en/latest/performance/packet-capture.html
> 
> Sorry to have pointed to old doc.
> 
> BR,
> -- Eric Leblond <eric at regit.org>
> _______________________________________________ Suricata IDS Users
> mailing list: oisf-users at openinfosecfoundation.org Site:
> http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List:
> https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> Suricata User Conference November 9-11 in Washington, DC: http://suricon.net


-- 
Cooper Nelson
Network Security Analyst
UCSD ITS Security Team
cnelson at ucsd.edu x41042

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20161115/129b9d39/attachment-0002.sig>