[Bro] dropped packets

[sangdrax8]

This is running in a cluster setup.  The nodes that are dropping are
actually physical machines, while I had a couple other nodes as VM's (which
see a tiny amount of traffic).  The VM's haven't dropped anything, but with
the small traffic they see that didn't surprise me.  I was just surprised
when I keep getting notice log entries for the physical machines dropping,
when I expected them to be able to handle a much bigger load.

I think I will take your advice and focus more getting some use out of my
setup.  I didn't expect loss when the box doesn't seem loaded, but if less
than 1-2% loss isn't going to negatively impact my usage, I probably don't
need to spend time trying to tweak it away.


On Thu, Mar 6, 2014 at 8:07 AM, Seth Hall <seth at icir.org> wrote:

>
> On Mar 6, 2014, at 7:33 AM, sangdrax8 <sangdrax8 at gmail.com> wrote:
>
> > Well, that explains the interval.  The example I posted was one of the
> smallest loss amounts, but what is an acceptable or expected loss level?
>  In the last 6 hours my setup does have a 1448 out of 206031, or .7%.  So
> .005% seems small, is .7% small?
>
> For most people anything under 1-2% is pretty acceptable.  You could
> probably work to get rid of that last bit of loss (which I have no clue why
> that's happening on such a small link) but it's probably more worth your
> time to start using Bro to achieve some goals within your organization
> rather than make sure you aren't dropping any packets at all.
>
> > I am running the default local.bro, and it does have misc/scan loaded.
>  I turn that off and see if I still see loss, but if 1% or less is
> considered normal loss even for a low load and small traffic, then I guess
> it is less important.
>
> Are you running in standalone mode?  I guess I forgot to ask that, but it
> could be significant.
>
>  .Seth
>
> --
> Seth Hall
> International Computer Science Institute
> (Bro) because everyone has a network
> http://www.bro.org/
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20140306/9b7130c3/attachment.html