[Oisf-users] High Suricata capture.kernel_drops

[Michael Shirk]

Also checkout the sacred tome of performance in Suricata from Peter
(and I think some help from Michal)

https://github.com/pevma/SEPTun/blob/master/SEPTun.pdf

And SEPTun-Mark-II as well.


On Tue, Jul 10, 2018 at 3:19 PM, Andreas Herz <andi at geekosphere.org> wrote:
> On 10/07/18 at 15:00, fatema bannatwala wrote:
>> I am pretty new to Suricata and started to play around with it.
>> I have Suricata 4.0.4 running on a CentOS7 box, that has 20 cores (40
>> on-line cpus) and an intel  X710 NIC, and 64GB RAM.
>
> What kernel are you using and what driver versoin?
>
>> Any idea how can I reduce the kernel drop rate of packets? or how can I
>> check if af_packet threads are working correctly?
>
> Do you have looked into syslog etc. if there are any related messages?
>
> How is the systemload?
>
> --
> Andreas Herz
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>
> Conference: https://suricon.net
> Trainings: https://suricata-ids.org/training/



-- 
Michael Shirk
Daemon Security, Inc.
https://www.daemon-security.com