Project

General

Profile

Actions

Support #2635

closed

Multi-threading not working correctly

Added by FATEMA WALA about 6 years ago. Updated about 5 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Affected Versions:
Label:

Description

I have been troubleshooting an issue we are having with Suricata's multi-threading.
Some of the tcp based alerts aren't getting triggered when Suricata is running in IDS interface sniffing mode with AF_Packet.

While running it in offline mode, with runmode: single, reading a pcap of some traffic I generated from my laptop (using $curl -A "SearchProtect" http://cnn.com), will fire some alerts (eg: sid: 2022813), which never gets fired when running suricata in packet sniffing mode and generating same traffic from my laptop. I verified that the traffic is reaching the box and not getting dropped on the interface.

I narrowed down the issue to be something to do with how packets are getting distributed in multi-threading mode in suricata, and maybe because of packets re-ordering the tcp based alerts do not get fired often.
I have followed the steps in SepTune doc to pin the Interrupts/IRQs to the specific cpus and use rest as "workers", but no success so far.

Actions

Also available in: Atom PDF