[Bro] RSS and packet reordering

Seth Hall seth at icir.org
Mon Aug 25 07:06:13 PDT 2014

On Aug 20, 2014, at 3:30 AM, Björn Samvik <Bjorn.Samvik at netclean.com> wrote:

> Anyone have experience with RSS and have any ideas how the packet 
> reordering issue can be mitigated?

Are you using straight RSS without any modifications?  By default the Toeplitz hash that RSS uses is not a bidirectional hash.  i.e., each flow of a connection ends up on a different NIC queue.  As a general rule though, you should try to avoid anything that could result in packet reordering.

Another question, how are you making Bro attach to the various NIC hardware queues?


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 495 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20140825/c5f78561/attachment.bin 

More information about the Bro mailing list