Thanks! I will get that information shortly. Could you please till then point to the documentation\link that denote that suricata 6 is EOL. I need that information to create user story
I got your files via DM, but ideally attach those here so others could help or benefit as well.
This looks like a VM, what virtualization solution is used there?
You did not specify specifics on the af-packet section in the suricata.yaml. I would recommend to read through or docs on how to configure this section (Suricata User Guide — Suricata 7.0.7 documentation)
Runmode workers for example could result in higher performance and less CPU usage.
Besides that iperf is not a realistic nor ideal tool to test Suricata.
This looks like a VM, what virtualization solution is used there?
We are using openstack\kvm.
You did not specify specifics on the af-packet section in the suricata.yaml
Apart from specifying af-packet on command line, I have not made any other changes. Is there anything specific you suggest I should look at?
Runmode workers for example could result in higher performance and less CPU usage.
Can it be substantially big enough to bring CPU usage from 50-70% to 10%?
Besides that iperf is not a realistic nor ideal tool to test Suricata.
We are using iperf to test load on the server, not for suricata. We noticed that suricata is taking big chunk of cpu while doing that test. We need to keep on using iperf for performance testing.
This depends on the traffic you forward and the amount of signatures. If there is some solid traffic I would expect the CPU to be pretty occupied which is expected. Based on your stats.log you are already running into packet drops.
The iperf traffic pattern is not very realistic for a IDS/NSM like Suricata. But it is expected for Suricata to use quite some CPU resource for all the detection it is doing.