Project

General

Profile

Actions

Support #2643

closed

suricata 3.2 hang after a period time with pfring zc

Added by Ambria Tian over 5 years ago. Updated almost 5 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Affected Versions:
Label:

Description

Suricata version 3.2
suricata hang after a period time. It stop fetching packet from pf_ring. The "capture.kernel_packets" in stats.log remains unchanged since then.
I see this problem is https://redmine.openinfosecfoundation.org/issues/1838, and took the advice set "max-pending-packets" 5000 and I also add void U_WANT_SC_TO_HANG to avoid waiting in PacketPoolWaitForN(int n) . But the problem is still exist.

root@RealEyeServerITS:/proc/11922/net/pf_ring# ls
12649-eth4.8577 12663-eth4.8579 12673-eth4.8581 12682-eth5.8583 12697-eth5.8585 12708-eth5.8587 dev plugins_info
12656-eth4.8578 12667-eth4.8580 12678-eth4.8582 12689-eth5.8584 12704-eth5.8586 12715-eth5.8588 info stats
root@RealEyeServerITS:/proc/11922/net/pf_ring# cat info
PF_RING Version : 6.4.1 (unknown)
Total rings : 12

Standard (non ZC) Options
Ring slots : 5000
Slot version : 16
Capture TX : No [RX only]
IP Defragment : No
Socket Mode : Standard
Total plugins : 0
Cluster Fragment Queue : 19214
Cluster Fragment Discard : 0
root@RealEyeServerITS:/proc/11922/net/pf_ring# cat 12649-eth4.8577
Bound Device(s) : eth4
Active : 1
Breed : Standard
Appl. Name : Suricata
Socket Mode : RX+TX
Capture Direction : RX+TX
Sampling Rate : 1
IP Defragment : No
BPF Filtering : Disabled
Sw Filt Hash Rules : 0
Sw Filt WC Rules : 0
Hw Filt Rules : 0
Sw Filt Hash Match : 0
Sw Filt Hash Miss : 0
Poll Pkt Watermark : 128
Num Poll Calls : 194726
Channel Id Mask : 0xFFFFFFFFFFFFFFFF
Cluster Id : 96
Slot Version : 16 [6.4.1]
Min Num Slots : 5000
Bucket Len : 65535
Slot Len : 65744 [bucket+header]
Tot Memory : 328732672
Tot Packets : 971741078
Tot Pkt Lost : 956566186
Tot Insert : 15160466
Tot Read : 14806360
Insert Offset : 205348616
Remove Offset : 205545760
Num Free Slots : 0
TX: Send Ok : 0
TX: Send Errors : 0
Reflect: Fwd Ok : 0
Reflect: Fwd Errors: 0

Actions #1

Updated by Peter Manev over 5 years ago

Is this reproducible with 4.0.5 or 4.1RC2 ?

Actions #2

Updated by Victor Julien over 5 years ago

  • Priority changed from Urgent to Normal
  • Effort deleted (medium)
Actions #3

Updated by Victor Julien about 5 years ago

  • Tracker changed from Bug to Support
Actions #4

Updated by Andreas Herz almost 5 years ago

  • Status changed from New to Closed

Hi, we're closing this issue since there have been no further responses.
If you think this bug is still relevant, try to test it again with the
most recent version of suricata and reopen the issue. If you want to
improve the bug report please take a look at
https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Reporting_Bugs

Actions

Also available in: Atom PDF