Maybe this is gonna be a long post, sorry for that.
This is my setup:
A - Suricata monitoring 3 interfaces (port-mirror from the core switch).
B- 1 monitor WAN and the other 2 monitors LAN (two firewall interfaces).
After some testing, I noticed that having Suricata configured with the WAN and 1 of the LAN interfaces (via AF-Packet) the “kernel_drop” count is equal to 0.
Next, if I disable the WAN interface and configure Suricata with the two LAN interfaces, the “kernel_drop” count is 0 too.
NOTE: these tests were with the same config
If I enable all 3 interfaces at once, my “kernel_drop” count starts rising after some minutes. I tried everything from “ring-size”, “max-pending-packets”, “cpu-affinity”, “stream memcap”. I just can’t have 0 drops with the 3 interfaces activated.
Do you guys have any idea why this is happening?
Thanks in advance