Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    HELP: high packet loss with suricata on pfsense in IPS mode

    Scheduled Pinned Locked Moved IDS/IPS
    1 Posts 1 Posters 1.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M Offline
      Maurizio
      last edited by

      Hello everybody.

      I'm using suricata as IPS (legacy mode) into a VM with 8 vcpu and 8 GB RAM, observing flow between OPT1 and OPT2 interfaces, connected in a bridge. ruleset is very reduced.
      Incoming traffic is around 180 Mbit/sec; we are getting a lot of  kernel_drops with high packet loss.  We are not abled to find out the reason or possible bottleneck and hope someone of you, facing with similar issue, could help us.
      Attached several logs catched during tests and sysctl output. In particular, stats.log (suricata logs) show a lot of 'capture.kernel_drops'.
      Thanks in advance

      Maurizio

      stats.log.TXT
      vmstatZ.txt
      netstat.txt
      vmstatI.txt
      vmstatP.txt
      vmstatS.txt
      vmstatS.txt
      sysctl.txt

      1 Reply Last reply Reply Quote 0
      • First post
        Last post
      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.