[Bro] dropped packets
sangdrax8 at gmail.com
Thu Mar 6 05:38:02 PST 2014
This is running in a cluster setup. The nodes that are dropping are
actually physical machines, while I had a couple other nodes as VM's (which
see a tiny amount of traffic). The VM's haven't dropped anything, but with
the small traffic they see that didn't surprise me. I was just surprised
when I keep getting notice log entries for the physical machines dropping,
when I expected them to be able to handle a much bigger load.
I think I will take your advice and focus more getting some use out of my
setup. I didn't expect loss when the box doesn't seem loaded, but if less
than 1-2% loss isn't going to negatively impact my usage, I probably don't
need to spend time trying to tweak it away.
On Thu, Mar 6, 2014 at 8:07 AM, Seth Hall <seth at icir.org> wrote:
> On Mar 6, 2014, at 7:33 AM, sangdrax8 <sangdrax8 at gmail.com> wrote:
> > Well, that explains the interval. The example I posted was one of the
> smallest loss amounts, but what is an acceptable or expected loss level?
> In the last 6 hours my setup does have a 1448 out of 206031, or .7%. So
> .005% seems small, is .7% small?
> For most people anything under 1-2% is pretty acceptable. You could
> probably work to get rid of that last bit of loss (which I have no clue why
> that's happening on such a small link) but it's probably more worth your
> time to start using Bro to achieve some goals within your organization
> rather than make sure you aren't dropping any packets at all.
> > I am running the default local.bro, and it does have misc/scan loaded.
> I turn that off and see if I still see loss, but if 1% or less is
> considered normal loss even for a low load and small traffic, then I guess
> it is less important.
> Are you running in standalone mode? I guess I forgot to ask that, but it
> could be significant.
> Seth Hall
> International Computer Science Institute
> (Bro) because everyone has a network
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Bro