Suricata Performance

Leave the /etc/suricata/afpacket_p.yaml like:

%YAML 1.1
---
af-packet:
  - interface: eth2
    threads: 8
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes
    use-mmap: yes
    mmap-locked: yes
    tpacket-v3: yes
    block-size: 524288
    ring-size: 1000000

  - interface: eth3
    threads: 8
    cluster-id: 98
    cluster-type: cluster_flow
    defrag: yes
    use-mmap: yes
    mmap-locked: yes
    packet-v3: yes
    block-size: 524288
    ring-size: 1000000
  - interface: default

This is what we entered:

use-mmap: yes 
mmap-locked: yes 
tpacket-v3: yes 
block-size: 524288

Then restart suricata

Realise that in this case we are just using the eth2 interfaces. We will need make a test using both interfaces.
Also realise that we are using 14 threads in one interface, in this mode suricate start without drop any package and 1000000 instead of 100000 in the ring size

More examples here:
https://pevma.blogspot.com.es/2015/05/suricata-multiple-interface.html

El tunning mas complete de Suricata es:

-Stop the irqbalance service 
-Configurar the la interfaz con: 
/sbin/ethtool -C $IFACE adaptive-rx on rx-usecs 100 >/dev/null 2>&1; 
/sbin/ethtool -G $IFACE rx 1024 >/dev/null 2>&1; 
/sbin/ethtool -A $IFACE rx off tx off >/dev/null 2>&1; 
ip link set $IFACE promisc on arp off up >/dev/null 2>&1; 
ip link set dev $IFACE mtu 1572 >/dev/null 2>&1; 

En el fichero afpacket_p.yaml 
Cambiar el cluster-type cluster-type: cluster_flow 
Incrementar los threads threads: 8 
Añadir mmap-locked: yes 
Incrementar el ring-size ring-size: 1000000