HELP: high packet loss with suricata on pfsense in IPS mode
-
Hello everybody.
I'm using suricata as IPS (legacy mode) into a VM with 8 vcpu and 8 GB RAM, observing flow between OPT1 and OPT2 interfaces, connected in a bridge. ruleset is very reduced.
Incoming traffic is around 180 Mbit/sec; we are getting a lot of kernel_drops with high packet loss. We are not abled to find out the reason or possible bottleneck and hope someone of you, facing with similar issue, could help us.
Attached several logs catched during tests and sysctl output. In particular, stats.log (suricata logs) show a lot of 'capture.kernel_drops'.
Thanks in advanceMaurizio
stats.log.TXT
vmstatZ.txt
netstat.txt
vmstatI.txt
vmstatP.txt
vmstatS.txt
vmstatS.txt
sysctl.txt