HELP: high packet loss with suricata on pfsense in IPS mode



  • Hello everybody.

    I'm using suricata as IPS (legacy mode) into a VM with 8 vcpu and 8 GB RAM, observing flow between OPT1 and OPT2 interfaces, connected in a bridge. ruleset is very reduced.
    Incoming traffic is around 180 Mbit/sec; we are getting a lot of  kernel_drops with high packet loss.  We are not abled to find out the reason or possible bottleneck and hope someone of you, facing with similar issue, could help us.
    Attached several logs catched during tests and sysctl output. In particular, stats.log (suricata logs) show a lot of 'capture.kernel_drops'.
    Thanks in advance

    Maurizio

    stats.log.TXT
    vmstatZ.txt
    netstat.txt
    vmstatI.txt
    vmstatP.txt
    vmstatS.txt
    vmstatS.txt
    sysctl.txt


Log in to reply