Discrepancy Between `capture.kernel_drops` and `drops` Metrics in Suricata Logs

Help
1

Hi,

I’m currently analyzing Suricata logs while running it in AF_PACKET capture mode and have a couple of questions regarding the packet drop statistics.

  1. In the stats.log file, there is a capture.kernel_drops metric that indicates the number of packets dropped by the kernel. However, in the suricata.log file, there is another metric labeled drops, which often shows a different value. What is the difference between these two metrics and why their values might not align?

  2. In the stats.log file, there is also a capture.kernel_packets parameter that represents the total number of packets handled by the kernel. Does this count include the packets that were dropped (capture.kernel_drops), or does it only account for the packets that were successfully captured and processed by Suricata?

I think that capture.kernel_packets represents the number of packets sent to Suricata by the kernel, while capture.kernel_drops represents the number of packets discarded by the kernel, so never sent to Suricata. In conclusion, the drops metric in the suricata.log file likely refers to the packets that Suricata was unable to process after they were handed over by the kernel.

I’d appreciate any insights or references to documentation that could help clarify these points. Thank you!

Additional notes

  • Suricata version: 7.0.7 (from source)
  • OS: Ubuntu 22.04
2

  1. The number should not differ too much, could differ due to timing because it is logged normally when you stop Suricata.

  2. capture.kernel_packets includes the capture.kernel_drops as well, so you can calculate based on that the percentage of drops.