[Oisf-users] problem with af-packet in 3.1.2

[Peter Manev]

On Thu, Oct 13, 2016 at 8:26 AM, Peter Manev <petermanev at gmail.com> wrote:
> On Mon, Oct 10, 2016 at 6:56 PM, Michael Stone <mstone at mathom.us> wrote:
>> On Mon, Oct 10, 2016 at 06:28:43PM +0200, you wrote:
>>>
>>> The i210 driver loads ok - no err msg, everything is ok?
>>
>>
>> nada
>>
>> [    4.690220] igb: Intel(R) Gigabit Ethernet Network Driver - version
>> 5.3.0-k
>> [    4.690222] igb: Copyright (c) 2007-2014 Intel Corporation.
>> [    4.723005] igb 0000:01:00.0: added PHC on eth0
>> [    4.723009] igb 0000:01:00.0: Intel(R) Gigabit Ethernet Network
>> Connection
>> [    4.723014] igb 0000:01:00.0: eth0: (PCIe:2.5Gb/s:Width x1)
>> 00:0d:b9:42:d2:98
>> [    4.723019] igb 0000:01:00.0: eth0: PBA No: FFFFFF-0FF
>> [    4.723024] igb 0000:01:00.0: Using MSI-X interrupts. 4 rx queue(s), 4 tx
>> queue(s)
>> [    4.754244] igb 0000:02:00.0: added PHC on eth1
>> [    4.754247] igb 0000:02:00.0: Intel(R) Gigabit Ethernet Network
>> Connection
>> [    4.754251] igb 0000:02:00.0: eth1: (PCIe:2.5Gb/s:Width x1)
>> 00:0d:b9:42:d2:99
>> [    4.754255] igb 0000:02:00.0: eth1: PBA No: FFFFFF-0FF
>> [    4.754259] igb 0000:02:00.0: Using MSI-X interrupts. 4 rx queue(s), 4 tx
>> queue(s)
>> [    4.784832] igb 0000:03:00.0: added PHC on eth2
>> [    4.784835] igb 0000:03:00.0: Intel(R) Gigabit Ethernet Network
>> Connection
>> [    4.784840] igb 0000:03:00.0: eth2: (PCIe:2.5Gb/s:Width x1)
>> 00:0d:b9:42:d2:9a
>> [    4.784843] igb 0000:03:00.0: eth2: PBA No: FFFFFF-0FF
>> [    4.784847] igb 0000:03:00.0: Using MSI-X interrupts. 4 rx queue(s), 4 tx
>> queue(s)
>> [    7.700247] igb 0000:01:00.0 enp1s0: renamed from eth0
>> [    7.751720] igb 0000:02:00.0 enp2s0: renamed from eth1
>> [    7.801966] igb 0000:03:00.0 enp3s0: renamed from eth2
>> [    8.351481] igb 0000:02:00.0: changing MTU from 1500 to 9000
>> [   11.628667] igb 0000:01:00.0 enp1s0: igb: enp1s0 NIC Link is Up 1000 Mbps
>> Full Duplex, Flow Control: RX
>> [  240.425367] igb 0000:02:00.0 enp2s0: igb: enp2s0 NIC Link is Up 1000 Mbps
>> Full Duplex, Flow Control: None
>>
>>> I cant see why else would you have that.
>>
>>
>> Neither can I. At least I'm increasingly reassured that I'm not overlooking
>> something obvious.
>>>
>>> Can you share your suricata.yaml and suricata.log?
>>
>>
>> It's reproducible with the suricata.yaml from the source.
>> suricata.log:
>>
>> 10/10/2016 -- 12:47:02 - <Notice> - This is Suricata version 3.1.2 RELEASE
>> 10/10/2016 -- 12:47:23 - <Notice> - all 4 packet processing threads, 4
>> management threads initialized, engine started.
>>
>> it'll sit at 0% cpu with the NIC unplugged, then as soon as there are
>> packets to read it'll go to 100% on all cpus, doing nothing AFAICT. Even if
>> the cable is unplugged again all the cpus keep busy-looping.
>>
>

(Putting the discussion back on the mailing list)

It seems like a very specific case to that set up's NIC.
The only way I can think of tackling this would be to get a
reproducible hands on environment.

>
>> Mike Stone
>
>
>
> --
> Regards,
> Peter Manev



-- 
Regards,
Peter Manev