[Oisf-users] af-packet and Linux Kernel version

[Michał Purzyński]

The new afpacket from 4.4 will use card hash if rxhash variable is enabled.

Disable it with ethtool and verify with ethtool -k 

> On 15 Nov 2016, at 19:52, Cooper F. Nelson <cnelson at ucsd.edu> wrote:
> 
> Hi Eric and Peter!
> 
> Great meeting everyone @Suricon, I had an awesome time.
> 
> I've been reviewing our build here and can confirm we are still seeing
> the ixgbe asymmetric hashing issue even on a very recent kernel/driver
> (4.8.7).  I think what happened was that when I was doing my testing
> with the newer kernels I was only monitoring a single host, so the
> timing issues with asymmetric hashing on the NIC itself did not cause an
> issue.  Under load it's still a problem, however.
> 
> I've tried using a single RSS queue tied to one core as mentioned in
> your link, however on our system (2.8 Ghz Xeon) the core is pegged at
> 100% and we are seeing over 50% packet drops.  Is there a published
> tuning guide, including kernel and NIC/ethtool settings, for this
> configuration?
> 
> -Coop
> 
>> On 11/14/2016 3:24 PM, Eric Leblond wrote:
>> I meant 
>> 
>> http://suricata.readthedocs.io/en/latest/performance/packet-capture.html
>> 
>> Sorry to have pointed to old doc.
>> 
>> BR,
>> -- Eric Leblond <eric at regit.org>
>> _______________________________________________ Suricata IDS Users
>> mailing list: oisf-users at openinfosecfoundation.org Site:
>> http://suricata-ids.org | Support: http://suricata-ids.org/support/
>> List:
>> https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>> Suricata User Conference November 9-11 in Washington, DC: http://suricon.net
> 
> 
> -- 
> Cooper Nelson
> Network Security Analyst
> UCSD ITS Security Team
> cnelson at ucsd.edu x41042
> 
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> Suricata User Conference November 9-11 in Washington, DC: http://suricon.net