[Bro] Linux Kernel dropping a lot of packets

[Peter Van Epp]

On Tue, Mar 13, 2007 at 04:38:09PM -0700, Mark Dedlow wrote:
<snip>
> 
> I should add that I did not attempt a comprehensive comparison, and
> that the performance probably varies significantly as a function of
> variables such as traffic profile.  My tests used synthetic traffic
> with a single packet size mix (simulating our actual environment.)
> This was on 6.1 btw.
> 
> Mark

	A late thought on this subject: were you running a stock Linux kernel
(i.e. with just the pf-ring patches)? I use the config out of our HPC folks
with tcp stack tweaks which can (and does daily) do 995 megabits per second 
across a 40 msec latency light path on a grid cluster here (the 200 terabyte
file store is here the compute engines are in several other sites across 
town and several thousand miles away). The stock kernel (which we used by 
accident during a test one day) gets 35 megabits per second on that same gig 
link and I suspect that may impact capture performance too.
	When our HPC guys started up 5 or 6 years ago I suggested FreeBSD but 
testing indicated that a properly tuned Linux kernel was just as fast (at 
least in tcp :-))  as FreeBSD and was more common in Beowolf clusters so they 
went Linux. 

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada