[Oisf-users] Are kernel_drops a symptom of dysfunctional afpacket fanout and/or RSS?

[erik clark]

If you are trying to squash the rss queue to 1, it causes giant problems. I
didn't squash the queue and let suri handle its fanout using tpacket-v3
(you are on the same kernel branch as I am, so this should be fine), and
get about .01-.04% packet drops. I noticed you were working with the
queues; you might be shooting yourself in the foot with this.

YMMV, personal experience only. I shot an email about this earlier last
month, but not sure where that went. Peter was the last one to comment, not
sure if those guys are looking at that or not:

https://lists.openinfosecfoundation.org/pipermail/oisf-users/2017-July/007323.html
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20170803/2e9d159b/attachment-0002.html>