I'd like to see the effect of changing my Suricata hardware and software, and in particular make sure I can determine the rate above which I'll start to lose data. I'm running ESXi with 20 cores and lots of RAM but I also need to be able to run in extremely limited hardware in some cases also.
A clumsy way to do this is to use
tcpreplay --mbps xxx and try different values for
xxx. I can look at the log files using
wc -l *.log and see that I'm getting fewer log messages when, in my not very good setup,
xxx is between 10 and 20.
I do not see the string
kernel_drops in any of these log messages.
Isn't there a more elegant way to find the rate at which I just start to lose the ability to process packets?