Coalesce parameters and RX ring size

Please read through this very useful article :
http://netoptimizer.blogspot.dk/2014/06/pktgen-for-network-overload-testing.html

Coalesce parameters and RX ring size can have an impact on your IDS.
To see what are the coalesce parameters on the currently sniffing interface:

root@suricata:/var/log/suricata# ethtool -c eth3
Coalesce parameters for eth3:
Adaptive RX: off  TX: off
stats-block-usecs: 0
sample-interval: 0
pkt-rate-low: 0
pkt-rate-high: 0

rx-usecs: 1000
rx-frames: 0
rx-usecs-irq: 0
rx-frames-irq: 0

tx-usecs: 0
tx-frames: 0
tx-usecs-irq: 0
tx-frames-irq: 0

rx-usecs-low: 0
rx-frame-low: 0
tx-usecs-low: 0
tx-frame-low: 0

rx-usecs-high: 0
rx-frame-high: 0
tx-usecs-high: 0
tx-frame-high: 0

To change (try with different values) the coalesce parameter:

root@suricata:/var/log/suricata# ethtool -C eth3 rx-usecs 1
root@suricata:/var/log/suricata# ethtool -c eth3
Coalesce parameters for eth3:
Adaptive RX: off  TX: off
stats-block-usecs: 0
sample-interval: 0
pkt-rate-low: 0
pkt-rate-high: 0

rx-usecs: 1
rx-frames: 0
rx-usecs-irq: 0
rx-frames-irq: 0

tx-usecs: 0
tx-frames: 0
tx-usecs-irq: 0
tx-frames-irq: 0

rx-usecs-low: 0
rx-frame-low: 0
tx-usecs-low: 0
tx-frame-low: 0

rx-usecs-high: 0
rx-frame-high: 0
tx-usecs-high: 0
tx-frame-high: 0

Ring RX parameters on the network card play a role too:

root@suricata:~# ethtool -g eth3
Ring parameters for eth3:
Pre-set maximums:
RX:             4096
RX Mini:        0
RX Jumbo:       0
TX:            4096

Current hardware settings:
RX:             512
RX Mini:        0
RX Jumbo:       0
TX:             512

  To increase that to the max Pre-set RX:

root@suricata:~# ethtool -G eth3 rx 4096

To confirm:

root@suricata:~# ethtool -g eth3
Ring parameters for eth3:
Pre-set maximums:
RX:             4096
RX Mini:        0
RX Jumbo:       0
TX:             4096
Current hardware settings:
RX:             4096
RX Mini:        0
RX Jumbo:       0
TX:             512

Suggested approach – that worked best in my particular set up – for Suricata IDS/IPS deployment is to have the coalesce parameter to value 1 and increase the ring  RX size to the max available for that particular interface/card.

It is suggested that you try a few different scenarios with regards to the coalesce parameters in order to find the best combination that suits your needs.

Print Share Comment Cite Upload Translate

APA

() » Coalesce parameters and RX ring size. Retrieved from https://www.truth.cx/2014/06/10/coalesce-parameters-and-rx-ring-size/.

MLA

" » Coalesce parameters and RX ring size." - , https://www.truth.cx/2014/06/10/coalesce-parameters-and-rx-ring-size/

HARVARD

» Coalesce parameters and RX ring size., viewed ,

VANCOUVER

- » Coalesce parameters and RX ring size. [Internet]. [Accessed ]. Available from: https://www.truth.cx/2014/06/10/coalesce-parameters-and-rx-ring-size/

CHICAGO

" » Coalesce parameters and RX ring size." - Accessed . https://www.truth.cx/2014/06/10/coalesce-parameters-and-rx-ring-size/

IEEE

" » Coalesce parameters and RX ring size." [Online]. Available: https://www.truth.cx/2014/06/10/coalesce-parameters-and-rx-ring-size/. [Accessed: ]

Select a language: Afrikaans Albanian Arabic Armenian Basque Bengali Bulgarian Catalan Cambodian Chinese (Mandarin) Croatian Czech Danish Dutch English Estonian Fiji Finnish French Georgian German Greek Gujarati Hebrew Hindi Hungarian Icelandic Indonesian Irish Italian Japanese Javanese Korean Latin Latvian Lithuanian Macedonian Malay Malayalam Maltese Maori Marathi Mongolian Nepali Norwegian Persian Polish Portuguese Punjabi Quechua Romanian Russian Samoan Serbian Slovak Slovenian Spanish Swahili Swedish Tamil Tatar Telugu Thai Tibetan Tonga Turkish Ukrainian Urdu Uzbek Vietnamese Welsh Xhosa <br />Please read through this very useful article :<br /><a href="http://netoptimizer.blogspot.dk/2014/06/pktgen-for-network-overload-testing.html" >http://netoptimizer.blogspot.dk/2014/06/pktgen-for-network-overload-testing.html</a><br /><br />Coalesce parameters and RX ring size can have an impact on your IDS.<br />To see what are the coalesce parameters on the currently sniffing interface:<br /><br /><blockquote class="tr_bq">root@suricata:/var/log/suricata# <b>ethtool -c eth3</b><br />Coalesce parameters for eth3:<br />Adaptive RX: off  TX: off<br />stats-block-usecs: 0<br />sample-interval: 0<br />pkt-rate-low: 0<br />pkt-rate-high: 0<br /><br /><b>rx-usecs: 1000</b><br />rx-frames: 0<br />rx-usecs-irq: 0<br />rx-frames-irq: 0<br /><br />tx-usecs: 0<br />tx-frames: 0<br />tx-usecs-irq: 0<br />tx-frames-irq: 0<br /><br />rx-usecs-low: 0<br />rx-frame-low: 0<br />tx-usecs-low: 0<br />tx-frame-low: 0<br /><br />rx-usecs-high: 0<br />rx-frame-high: 0<br />tx-usecs-high: 0<br />tx-frame-high: 0</blockquote><br />To change (try with different values) the coalesce parameter:<br /><br /><blockquote class="tr_bq">root@suricata:/var/log/suricata# <b>ethtool -C eth3 rx-usecs 1</b><br />root@suricata:/var/log/suricata# <b>ethtool -c eth3</b><br />Coalesce parameters for eth3:<br />Adaptive RX: off  TX: off<br />stats-block-usecs: 0<br />sample-interval: 0<br />pkt-rate-low: 0<br />pkt-rate-high: 0<br /><br /><b>rx-usecs: 1</b><br />rx-frames: 0<br />rx-usecs-irq: 0<br />rx-frames-irq: 0<br /><br />tx-usecs: 0<br />tx-frames: 0<br />tx-usecs-irq: 0<br />tx-frames-irq: 0<br /><br />rx-usecs-low: 0<br />rx-frame-low: 0<br />tx-usecs-low: 0<br />tx-frame-low: 0<br /><br />rx-usecs-high: 0<br />rx-frame-high: 0<br />tx-usecs-high: 0<br />tx-frame-high: 0</blockquote><br />Ring RX parameters on the network card play a role too:<br /><br /><br /><blockquote class="tr_bq">root@suricata:~# ethtool -g eth3<br />Ring parameters for eth3:<br />Pre-set maximums:<br />RX:             4096<br />RX Mini:        0<br />RX Jumbo:       0<br />TX:            4096</blockquote><blockquote>Current hardware settings:<br /><b>RX:             512</b><br />RX Mini:        0<br />RX Jumbo:       0<br />TX:             512</blockquote><br /><br />  To increase that to the max Pre-set RX:<br /><br /><blockquote class="tr_bq">root@suricata:~# ethtool -G eth3 rx 4096</blockquote><br />To confirm:<br /><br /><blockquote class="tr_bq">root@suricata:~# ethtool -g eth3<br />Ring parameters for eth3:<br />Pre-set maximums:<br />RX:             4096<br />RX Mini:        0<br />RX Jumbo:       0<br />TX:             4096<br />Current hardware settings:<br /><b>RX:             4096</b><br />RX Mini:        0<br />RX Jumbo:       0<br />TX:             512</blockquote><br />Suggested approach - that worked best in my particular set up - for Suricata IDS/IPS deployment is to have the coalesce parameter to value 1 and increase the ring  RX size to the max available for that particular interface/card.<br /><br />It is suggested that you try a few different scenarios with regards to the coalesce parameters in order to find the best combination that suits your needs.<br /><br /><br /><br /><br /><br /> First name:

Last name: