[Bro] PF_RING for Bro
sstattla at gmail.com
Mon Dec 13 14:50:11 PST 2010
Alternatively, can I have the source code for multi-threaded Bro? : )
On 10-12-13 2:44 PM, Sunjeet Singh wrote:
> I am looking at increasing the performance of Bro by making use of
> PF_RING and TNAPI, at the kernel and driver level in Linux. These
> existing tools from http://www.ntop.org/news.php allow multi-threaded
> applications to drastically increase performance by making use of
> functionality that exists in several network cards today.
> While PF_RING, TNAPI and other network-card functionality allow for
> phenomenal speed-up, they have to be tuned right or else they can lead
> to a negative effect on performance. So I'm trying to determine how to
> tune them to meet Bro's needs.
> As Multi-threaded Bro is not ready yet, I am trying to think of a
> SIMPLE application that can best characterize the Bro workload. The
> design criteria that I have for this application so far is-
> 1. Send every packet belonging to a particular connection to the same
> 2. Introduce a small wait on every packet to simulate Bro's processing
> of that packet? What will be a good value?
> I'd be very interested to have everyone's opinion on this. I really am
> looking for a very simple algorithm that will be a right approximation.
> Thank you,
> Sunjeet Singh
More information about the Bro