[Bro-Dev] snaplen and drops
mcholste at gmail.com
Thu Oct 27 09:15:31 PDT 2011
That's very weird. It's abnormal to get packets > 1514, right? Are
you monitoring a link with a lot of jumbo packets? Something is
wrong, as that small bandwidth shouldn't matter no matter what the
packet sizes are anyway.
On Wed, Oct 26, 2011 at 11:24 PM, Robin Sommer <robin at icir.org> wrote:
> On a reasonable fast Linux box seeing (currently) <10M/bps, I'm
> getting lots packet drops with current master, even though CPU is very
> low. I did the usual sysctl tuning, but that didn't help. Then I
> reduced the snaplen (which now defaults to 65K) down to 8K, and the
> drops disappeared.
> That seems is quite an extreme effect of the new default value. Should
> we reconsider and (1) use a smaller default, and/or (2) make the
> snaplen accesible from the scripting layer (right now, there's only
> -s; which doens't work well with BroControl).
> Is there other tuning to get around the problem (with standard kernel,
> not PF_RING etc.)?
> Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
> ICSI/LBNL * Fax +1 (510) 666-2956 * www.icir.org
> bro-dev mailing list
> bro-dev at bro-ids.org
More information about the bro-dev