Project

General

Profile

Actions

Support #2643

closed

suricata 3.2 hang after a period time with pfring zc

Added by Ambria Tian over 5 years ago. Updated almost 5 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Affected Versions:
Label:

Description

Suricata version 3.2
suricata hang after a period time. It stop fetching packet from pf_ring. The "capture.kernel_packets" in stats.log remains unchanged since then.
I see this problem is https://redmine.openinfosecfoundation.org/issues/1838, and took the advice set "max-pending-packets" 5000 and I also add void U_WANT_SC_TO_HANG to avoid waiting in PacketPoolWaitForN(int n) . But the problem is still exist.

root@RealEyeServerITS:/proc/11922/net/pf_ring# ls
12649-eth4.8577 12663-eth4.8579 12673-eth4.8581 12682-eth5.8583 12697-eth5.8585 12708-eth5.8587 dev plugins_info
12656-eth4.8578 12667-eth4.8580 12678-eth4.8582 12689-eth5.8584 12704-eth5.8586 12715-eth5.8588 info stats
root@RealEyeServerITS:/proc/11922/net/pf_ring# cat info
PF_RING Version : 6.4.1 (unknown)
Total rings : 12

Standard (non ZC) Options
Ring slots : 5000
Slot version : 16
Capture TX : No [RX only]
IP Defragment : No
Socket Mode : Standard
Total plugins : 0
Cluster Fragment Queue : 19214
Cluster Fragment Discard : 0
root@RealEyeServerITS:/proc/11922/net/pf_ring# cat 12649-eth4.8577
Bound Device(s) : eth4
Active : 1
Breed : Standard
Appl. Name : Suricata
Socket Mode : RX+TX
Capture Direction : RX+TX
Sampling Rate : 1
IP Defragment : No
BPF Filtering : Disabled
Sw Filt Hash Rules : 0
Sw Filt WC Rules : 0
Hw Filt Rules : 0
Sw Filt Hash Match : 0
Sw Filt Hash Miss : 0
Poll Pkt Watermark : 128
Num Poll Calls : 194726
Channel Id Mask : 0xFFFFFFFFFFFFFFFF
Cluster Id : 96
Slot Version : 16 [6.4.1]
Min Num Slots : 5000
Bucket Len : 65535
Slot Len : 65744 [bucket+header]
Tot Memory : 328732672
Tot Packets : 971741078
Tot Pkt Lost : 956566186
Tot Insert : 15160466
Tot Read : 14806360
Insert Offset : 205348616
Remove Offset : 205545760
Num Free Slots : 0
TX: Send Ok : 0
TX: Send Errors : 0
Reflect: Fwd Ok : 0
Reflect: Fwd Errors: 0

Actions

Also available in: Atom PDF