I'd like to see the effect of changing my Suricata hardware and software, and in particular make sure I can determine the rate above which I'll start to lose data. I'm running ESXi with 20 cores and lots of RAM but I also need to be able to run in extremely limited hardware in some cases also.

A clumsy way to do this is to use tcpreplay --mbps xxx and try different values for xxx. I can look at the log files using wc -l *.log and see that I'm getting fewer log messages when, in my not very good setup, xxx is between 10 and 20.

I do not see the string kernel_drops in any of these log messages.

Isn't there a more elegant way to find the rate at which I just start to lose the ability to process packets?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.