Open Information Security Foundation

04/02/2017

05:10 AM Suricata Bug #1838: suricata 3.0* and 3.1 hang after heavy traffic w/ pfring zc (reproducible)

As I eluded to earlier, this call is the issue:
void PacketPoolWaitForN(int n)
{
#ifdef U_WANT_SC_TO_HANG
flo... kevin buchanan

01/29/2017

11:46 PM Suricata Bug #1838: suricata 3.0* and 3.1 hang after heavy traffic w/ pfring zc (reproducible)

It occurs w/ or w/o ZC w/ 1024 pkt pools, but not w/ 4096. If I remember correctly 2048 was also a problem.
I switch... kevin buchanan

09/21/2016

04:36 AM Suricata Bug #1838: suricata 3.0* and 3.1 hang after heavy traffic w/ pfring zc (reproducible)

It's pretty easy to reproduce. If it's un-reproducible there, then I'll see what I can do, but
I don't currently ha... kevin buchanan

03:26 AM Suricata Bug #1838: suricata 3.0* and 3.1 hang after heavy traffic w/ pfring zc (reproducible)

... kevin buchanan

09/20/2016

10:06 PM Suricata Bug #1838: suricata 3.0* and 3.1 hang after heavy traffic w/ pfring zc (reproducible)

The stats/ is empty. This is a VM w/ a recent ntop PF RING package installed
and currently non-responsive. Default m... kevin buchanan

08/03/2016

06:24 AM Suricata Bug #1838: suricata 3.0* and 3.1 hang after heavy traffic w/ pfring zc (reproducible)

Looks like my last comment was premature. While it takes longer it still occurs w/ suggested changes and back to 1024... kevin buchanan

01:03 AM Suricata Bug #1838: suricata 3.0* and 3.1 hang after heavy traffic w/ pfring zc (reproducible)

max-pending-packets: 1024
established: 360
makes a significant improvement in general thanks. not sure how that ... kevin buchanan

08/02/2016

01:13 AM Suricata Bug #1838: suricata 3.0* and 3.1 hang after heavy traffic w/ pfring zc (reproducible)

Absolutely. Running w/ max-packets=1204 and flow-timeout=360 now. Will advise; thanks.
kevin buchanan

07/21/2016

03:47 PM Suricata Bug #1838: suricata 3.0* and 3.1 hang after heavy traffic w/ pfring zc (reproducible)

In my experience this could be considered a psirt so closing it doesn't seem like an option.
Using 64K packets per t... kevin buchanan

07/08/2016

01:39 AM Suricata Bug #1838: suricata 3.0* and 3.1 hang after heavy traffic w/ pfring zc (reproducible)

That number suffices in our environments; for now. Thanks. kevin buchanan