Suricata
suricata-6.0.20
1. What is Suricata
2. Quickstart guide
3. Installation
4. Upgrading
5. Security Considerations
6. Command Line Options
7. Suricata Rules
8. Rule Management
9. Making sense out of Alerts
10. Performance
10.1. Runmodes
10.2. Packet Capture
10.3. Tuning Considerations
10.4. Hyperscan
10.5. High Performance Configuration
10.6. Statistics
10.7. Ignoring Traffic
10.8. Packet Profiling
10.9. Rule Profiling
10.10. Tcmalloc
10.11. Performance Analysis
11. Configuration
12. Reputation
13. Init Scripts
14. Setting up IPS/inline for Linux
15. Setting up IPS/inline for Windows
16. Output
17. Lua support
18. File Extraction
19. Public Data Sets
20. Using Capture Hardware
21. Interacting via Unix Socket
22. 3rd Party Integration
23. Man Pages
24. Acknowledgements
25. Licenses
Suricata
10.
Performance
Edit on GitHub
10.
Performance
10.1. Runmodes
10.1.1. Different runmodes
10.2. Packet Capture
10.2.1. Load balancing
10.2.2. RSS
10.2.3. Offloading
10.2.4. Recommendations
10.3. Tuning Considerations
10.3.1. max-pending-packets: <number>
10.3.2. mpm-algo: <ac|hs|ac-bs|ac-ks>
10.3.3. detect.profile: <low|medium|high|custom>
10.3.4. detect.sgh-mpm-context: <auto|single|full>
10.3.5. af-packet
10.3.6. ring-size
10.3.7. stream.bypass
10.4. Hyperscan
10.4.1. Introduction
10.4.2. Basic Installation (Package)
10.4.3. Advanced Installation (Source)
10.4.4. Using Hyperscan
10.5. High Performance Configuration
10.5.1. NIC
10.5.2. CPU affinity and NUMA
10.5.2.1. Intel based systems
10.5.2.2. AMD based systems
10.5.2.3. Other considerations
10.6. Statistics
10.6.1. stats.log file
10.6.1.1. Detecting packet loss
10.6.2. Kernel drops
10.6.3. Tools to plot graphs
10.7. Ignoring Traffic
10.7.1. capture filters (BPF)
10.7.1.1. BPF and IPS
10.7.2. pass rules
10.7.3. suppress
10.7.4. encrypted traffic
10.7.5. bypassing traffic
10.8. Packet Profiling
10.9. Rule Profiling
10.10. Tcmalloc
10.10.1. Installation
10.10.2. Usage
10.11. Performance Analysis
10.11.1. System Load
10.11.2. Logfiles
10.11.3. Suricata Load
10.11.4. Traffic
10.11.4.1. Basics
10.11.4.2. Advanced
10.11.4.3. Elephant Flows
10.11.5. Rules