Suricata kernel drops only in specific threads

Help
1

Hi all,

I am tuning suricata by following 9.5. High Performance Configuration — Suricata 6.0.1 documentation.
When I look at the stats.log file, the kernel drops only in specific threads.

Is there any way to balance between worker threads?

Thanks for checking and helping out in advance!

26/11/2021 -- 22:17:42 - <Perf> - (W#01-enp175s0f1) Kernel: Packets 4625672, dropped 0
26/11/2021 -- 22:17:42 - <Perf> - (W#02-enp175s0f1) Kernel: Packets 4521758, dropped 0
26/11/2021 -- 22:17:42 - <Perf> - (W#03-enp175s0f1) Kernel: Packets 6090727, dropped 0
26/11/2021 -- 22:17:42 - <Perf> - (W#04-enp175s0f1) Kernel: Packets 5646082, dropped 0
26/11/2021 -- 22:17:42 - <Perf> - (W#05-enp175s0f1) Kernel: Packets 5738790, dropped 0
26/11/2021 -- 22:17:42 - <Perf> - (W#06-enp175s0f1) Kernel: Packets 5833171, dropped 0
26/11/2021 -- 22:17:42 - <Perf> - (W#07-enp175s0f1) Kernel: Packets 4869394, dropped 0
26/11/2021 -- 22:17:42 - <Perf> - (W#08-enp175s0f1) Kernel: Packets 18547979, dropped 4717093
26/11/2021 -- 22:17:42 - <Perf> - (W#09-enp175s0f1) Kernel: Packets 5730851, dropped 0
26/11/2021 -- 22:17:42 - <Perf> - (W#10-enp175s0f1) Kernel: Packets 5864215, dropped 0
26/11/2021 -- 22:17:42 - <Perf> - (W#11-enp175s0f1) Kernel: Packets 15585927, dropped 6914021
26/11/2021 -- 22:17:42 - <Perf> - (W#12-enp175s0f1) Kernel: Packets 5947478, dropped 0
26/11/2021 -- 22:17:42 - <Perf> - (W#13-enp175s0f1) Kernel: Packets 7723735, dropped 0
26/11/2021 -- 22:17:42 - <Perf> - (W#14-enp175s0f1) Kernel: Packets 5736643, dropped 0
26/11/2021 -- 22:17:42 - <Perf> - (W#15-enp175s0f1) Kernel: Packets 4722412, dropped 0
26/11/2021 -- 22:17:42 - <Perf> - (W#16-enp175s0f1) Kernel: Packets 4961474, dropped 0
26/11/2021 -- 22:17:42 - <Perf> - (W#01-enp59s0f0) Kernel: Packets 11872804, dropped 0
26/11/2021 -- 22:17:42 - <Perf> - (W#02-enp59s0f0) Kernel: Packets 17737492, dropped 0
26/11/2021 -- 22:17:42 - <Perf> - (W#03-enp59s0f0) Kernel: Packets 10433465, dropped 0
26/11/2021 -- 22:17:42 - <Perf> - (W#04-enp59s0f0) Kernel: Packets 16174434, dropped 0
26/11/2021 -- 22:17:42 - <Perf> - (W#05-enp59s0f0) Kernel: Packets 11366179, dropped 0
26/11/2021 -- 22:17:42 - <Perf> - (W#06-enp59s0f0) Kernel: Packets 11283527, dropped 0
26/11/2021 -- 22:17:42 - <Perf> - (W#07-enp59s0f0) Kernel: Packets 12704160, dropped 0
26/11/2021 -- 22:17:42 - <Perf> - (W#08-enp59s0f0) Kernel: Packets 43202504, dropped 740379
26/11/2021 -- 22:17:42 - <Perf> - (W#09-enp59s0f0) Kernel: Packets 10494391, dropped 0
26/11/2021 -- 22:17:43 - <Perf> - (W#10-enp59s0f0) Kernel: Packets 10687169, dropped 0
26/11/2021 -- 22:17:43 - <Perf> - (W#11-enp59s0f0) Kernel: Packets 76754177, dropped 14128966
26/11/2021 -- 22:17:43 - <Perf> - (W#12-enp59s0f0) Kernel: Packets 8945353, dropped 0
26/11/2021 -- 22:17:43 - <Perf> - (W#13-enp59s0f0) Kernel: Packets 10800281, dropped 0
26/11/2021 -- 22:17:43 - <Perf> - (W#14-enp59s0f0) Kernel: Packets 10604365, dropped 0
26/11/2021 -- 22:17:43 - <Perf> - (W#15-enp59s0f0) Kernel: Packets 12290352, dropped 0
26/11/2021 -- 22:17:43 - <Perf> - (W#16-enp59s0f0) Kernel: Packets 9873522, dropped 0
2

Which version are you running, what hardware (CPU and NIC) and how did you configure suricata and the NIC?

In general such a bad balancing is a bad flow hashing, can be either elephant flows, broken traffic, vlan qinq and others.