[Oisf-users] _fail Stats Q

[Kerry Milestone]

Hello there,

where would I begin looking to lower these numbers?


capture.kernel_packets                     | Total                     |
182210562
capture.kernel_drops                       | Total                     |
33751


tcp.segment_memcap_drop                    | Total                     | 949
tcp.insert_data_normal_fail                | Total                     |
12007870
tcp.insert_data_overlap_fail               | Total                     | 14
tcp.insert_list_fail                       | Total                     |
262760
app_layer.flow.failed_tcp                  | Total                     |
11026
app_layer.flow.failed_udp                  | Total                     |
575269


I see the stats come from here:

    stt->ra_ctx->counter_tcp_reass_data_normal_fail =
StatsRegisterCounter("tcp.insert_data_normal_fail", tv);
stt->ra_ctx->counter_tcp_reass_data_overlap_fail =
StatsRegisterCounter("tcp.insert_data_overlap_fail", tv);

but I can't seem to change any memcaps levels,reassembly etc to lower.

Many thanks for any {cough} pointers given.

Kerry.







-- 
The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.