[Oisf-users] Suricata Performance Tuning

[Edgmand, Craig]

The answer is Hyperscan!

Packet drops went from 9% to less than 1% (0.33) after installing Hyperscan and recompiling.   No other changes.



-----Original Message-----
From: Oisf-users <oisf-users-bounces at lists.openinfosecfoundation.org> On Behalf Of Andreas Herz
Sent: Thursday, August 30, 2018 4:08 PM
To: oisf-users at lists.openinfosecfoundation.org
Subject: Re: [Oisf-users] Suricata Performance Tuning

On 30/08/18 at 15:03, Edgmand, Craig wrote:
>        And what I want to know is what performance tuning options have the greatest impact?   Outside of buying faster processors, more memory or a different nic card.  :)
> 
>                 Is it the suricata.yaml configuration options?
> 
>                 Is it hyperscan?
> 
>                 Sysctl settings?
> 
>                 Ethtool tweaks?
> 
>                 BIOS setting?
> 
>                 CPU Pinning?
>                 ???

Did you try hyperscan?

All in all we might need more details about the setup/configuration.

-- 
Andreas Herz
_______________________________________________
Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
Site: https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsuricata-ids.org&data=02%7C01%7Ccraig.edgmand%40okstate.edu%7C79c4c8f6e2a7400ea13a08d60ebcaae0%7C2a69c91de8494e34a230cdf8b27e1964%7C0%7C0%7C636712600817245804&sdata=lb4sQimTnurWhxbr008IkK5KrEp8dbSBJQJf2j9skn8%3D&reserved=0 | Support: https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsuricata-ids.org%2Fsupport%2F&data=02%7C01%7Ccraig.edgmand%40okstate.edu%7C79c4c8f6e2a7400ea13a08d60ebcaae0%7C2a69c91de8494e34a230cdf8b27e1964%7C0%7C0%7C636712600817245804&sdata=bCneWL27s7rw0SMpsFkrmWkXBiZT5RURuhuXVKsvAKU%3D&reserved=0
List: https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.openinfosecfoundation.org%2Fmailman%2Flistinfo%2Foisf-users&data=02%7C01%7Ccraig.edgmand%40okstate.edu%7C79c4c8f6e2a7400ea13a08d60ebcaae0%7C2a69c91de8494e34a230cdf8b27e1964%7C0%7C0%7C636712600817245804&sdata=NCHNHdT%2FK0sWVvMw2J68RDuspaSJfVqQlZJQyyFiNO8%3D&reserved=0

Conference: https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsuricon.net&data=02%7C01%7Ccraig.edgmand%40okstate.edu%7C79c4c8f6e2a7400ea13a08d60ebcaae0%7C2a69c91de8494e34a230cdf8b27e1964%7C0%7C0%7C636712600817245804&sdata=u%2B0Z%2F09LhPPvUCtYbrnCtY2rPtHc7INTN9a4rip1IR8%3D&reserved=0
Trainings: https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsuricata-ids.org%2Ftraining%2F&data=02%7C01%7Ccraig.edgmand%40okstate.edu%7C79c4c8f6e2a7400ea13a08d60ebcaae0%7C2a69c91de8494e34a230cdf8b27e1964%7C0%7C0%7C636712600817245804&sdata=6wssDUTYL%2F5qr1BEWqayc%2Fo8J88zhoDyVfToiEWLyGw%3D&reserved=0