[Oisf-users] suricata 3.2.0 for 10Gb performance

[erik clark]

I am seeing packets truncated at about 1 or 2 with tpacket_v3 running. With
the default of 1514, I was not seeing packets truncated unless I had bro
and suricata running at the same time. Not sure why that might have been.
Still waiting on a response from RH, but this appears to work combined with
the ixgbe patch on RHEL7.

On Fri, Jan 20, 2017 at 5:28 PM, Cooper F. Nelson <cnelson at ucsd.edu> wrote:

> Look for log entries with "trunc_pkt" in the stats.log file to see if
> you aren't capturing full packets.
>
> You have to explicitly enable the tpacket-v3 setting in suricata.yaml to
> make use of it.
>
> -Coop
>
> On 1/20/2017 2:11 PM, erik clark wrote:
> > Interesting. I will doublecheck with RH on Monday regarding tpacket-v3 in
> > RHEL7. I know that 6 isn't compliant though.
>
>
> --
> Cooper Nelson
> Network Security Analyst
> UCSD ITS Security Team
> cnelson at ucsd.edu x41042
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20170124/6808c6f1/attachment-0002.html>