[Bro-Dev] Running bro with newer 10 GigE cards that Coalesce packeets in the hardware

[William Jones]

This takes many packets and presents them to bro as one very large packet 10K.  

MTU    Throughput Mbyutes/sec   Packet Rate       Bro Packet Rate
1500             470               300K	          24K
 512             287               560K             21K

There were no  drops reported and no errors that I would normal see on the nics if I turned off coalescing.  

This does require  increasing the pcap snap length.

Can anyone think of any down side to running bro with packet coalescing nic's.    


-----Original Message-----
From: bro-dev-bounces at bro-ids.org [mailto:bro-dev-bounces at bro-ids.org] On Behalf Of Robin Sommer
Sent: Friday, May 06, 2011 3:17 PM
To: Seth Hall
Cc: Bro Dev
Subject: Re: [Bro-Dev] RPC and NFS Analyzers


On Fri, May 06, 2011 at 13:49 -0400, you wrote:

> Let's integrate them and I'll start writing/adapting scripts in the policy-scripts-new branch!

Sounds good to me too.

Robin

-- 
Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org
_______________________________________________
bro-dev mailing list
bro-dev at bro-ids.org
http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev