[Oisf-users] suricata 4.1 eBpf load balance

[mazhuang at 17paipai.cn]

Hi Eric
I counted the last 24 hours of host information: source address 7000+ destination address 1000+



mazhuang at 17paipai.cn
 
From: Eric Leblond
Date: 2018-10-08 14:29
To: mazhuang at 17paipai.cn; Konstantin Klinger; Michal Purzynski
CC: oisf-users
Subject: Re: Re: [Oisf-users] suricata 4.1 eBpf load balance
Hello,
 
On Mon, 2018-10-08 at 11:57 +0800, mazhuang at 17paipai.cn wrote:
> Hi Eric
>  I used the new code, and the permission issue was resolved, but the
> load balancing issue remained
 
OK.
 
> 
> 
> [root at yg suricata]# suricata --af-packet=ens4f1 --runmode=workers  -c 
> /etc/suricata/suricata.yaml -vvv
...
> dropped 0
> [14953] 8/10/2018 -- 11:48:11 - (source-af-packet.c:1249) <Info>
> (AFPSwitchState) -- Cleaning socket connected to 'ens4f1'
> [14954] 8/10/2018 -- 11:48:11 - (source-af-packet.c:2655) <Perf>
> (ReceiveAFPThreadExitStats) -- (W#16-ens4f1) Kernel: Packets 524725,
> dropped 224653
> [14954] 8/10/2018 -- 11:48:11 - (source-af-packet.c:1249) <Info>
> (AFPSwitchState) -- Cleaning socket connected to 'ens4f1'
> [14754] 8/10/2018 -- 11:48:11 - (counters.c:815) <Info>
> (StatsLogSummary) -- Alerts: 128
> [14754] 8/10/2018 -- 11:48:12 - (ippair.c:290) <Perf>
> (IPPairPrintStats) -- ippair memory usage: 414144 bytes, maximum:
> 16777216
> [14754] 8/10/2018 -- 11:48:12 - (host.c:294) <Perf> (HostPrintStats)
> -- host memory usage: 604320 bytes, maximum: 33554432
> [14754] 8/10/2018 -- 11:48:12 - (detect-engine-build.c:1704) <Info>
> (SigAddressCleanupStage1) -- cleaning up signature grouping
> structure... complete
> [14754] 8/10/2018 -- 11:48:12 - (util-device.c:328) <Notice>
> (LiveDeviceListClean) -- Stats for 'ens4f1':  pkts: 41029800, drop:
> 34453226 (83.97%), invalid chksum: 54
 
It does not looks really fair indeed. What is the traffic you are
testing it with ? How many different hosts are involved ?
 
BR,
-- 
Eric Leblond <eric at regit.org>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20181008/d72eca64/attachment.html>