af_packet: High latency
Same configuration as in https://redmine.openinfosecfoundation.org/issues/2099
Network topology is simple:
[host1 eno50] <-> [eno50 host2(suricata) eno49] <-> [eno50 host3]
host1# ip addr add 192.168.99.1/24 dev eno50 host3# ip addr add 192.168.99.2/24 dev eno50
host3# ping 192.168.99.1 -c 1000 -q -f PING 192.168.99.1 (192.168.99.1) 56(84) bytes of data. --- 192.168.99.1 ping statistics --- 1000 packets transmitted, 1000 received, 0% packet loss, time 19977ms rtt min/avg/max/mdev = 23.308/26.272/39.973/0.457 ms, pipe 3, ipg/ewma 19.997/26.274 ms
When using NFQUEUE and routing through Suricata the latency is fine (sub-millisecond)
Updated by Igor Novgorodov over 5 years ago
Yes, the CRIT log message during startup would be very nice and some mention in the docs, so others would not guess the cause of latency.
Sadly, but V2's performance is much worse. I was able to achieve the 0% drop on V2 only with 35% lower PPS than with V3.