[Bro] Linux Kernel dropping a lot of packets

[Mark Dedlow]

Peter Van Epp wrote:
> 	If you are up for adventure you should look at the pf-ring code from
> www.ntop.org. While fairly exciting to get in (it replaces the native pcap
> code in the kernel) once you do it appears to work fairly well. On an earlier
> version of pf-ring we managed to keep up with a 995 megabit jumbo frame netperf
> run with argus (the jumbos however are the best case traffic senario). I have
> the latest version running in an IBM P510 in OpenSUSE 10.2 and a 2.6.18 kernel
> (I think) but haven't yet managed to get it in to a busy gig link yet (the 
> original link has gone 10 gig in the interrum and is thus no longer available
> :-)). Small packets are its most likely weakness.

I tested this recently, and while a great improvement, it was
still considerably less than out-of-the-box FreeBSD performance.

Mark