[Oisf-users] suricata 4.1 eBpf load balance

[Eric Leblond]

Hello,

On Mon, 2018-10-08 at 11:57 +0800, mazhuang at 17paipai.cn wrote:
> Hi Eric
>  I used the new code, and the permission issue was resolved, but the
> load balancing issue remained

OK.

> 
> 
> [root at yg suricata]# suricata --af-packet=ens4f1 --runmode=workers  -c 
> /etc/suricata/suricata.yaml -vvv
...
> dropped 0
> [14953] 8/10/2018 -- 11:48:11 - (source-af-packet.c:1249) <Info>
> (AFPSwitchState) -- Cleaning socket connected to 'ens4f1'
> [14954] 8/10/2018 -- 11:48:11 - (source-af-packet.c:2655) <Perf>
> (ReceiveAFPThreadExitStats) -- (W#16-ens4f1) Kernel: Packets 524725,
> dropped 224653
> [14954] 8/10/2018 -- 11:48:11 - (source-af-packet.c:1249) <Info>
> (AFPSwitchState) -- Cleaning socket connected to 'ens4f1'
> [14754] 8/10/2018 -- 11:48:11 - (counters.c:815) <Info>
> (StatsLogSummary) -- Alerts: 128
> [14754] 8/10/2018 -- 11:48:12 - (ippair.c:290) <Perf>
> (IPPairPrintStats) -- ippair memory usage: 414144 bytes, maximum:
> 16777216
> [14754] 8/10/2018 -- 11:48:12 - (host.c:294) <Perf> (HostPrintStats)
> -- host memory usage: 604320 bytes, maximum: 33554432
> [14754] 8/10/2018 -- 11:48:12 - (detect-engine-build.c:1704) <Info>
> (SigAddressCleanupStage1) -- cleaning up signature grouping
> structure... complete
> [14754] 8/10/2018 -- 11:48:12 - (util-device.c:328) <Notice>
> (LiveDeviceListClean) -- Stats for 'ens4f1':  pkts: 41029800, drop:
> 34453226 (83.97%), invalid chksum: 54

It does not looks really fair indeed. What is the traffic you are
testing it with ? How many different hosts are involved ?

BR,
-- 
Eric Leblond <eric at regit.org>