[Bro] A few questions
Justin Azoff
JAzoff at uamail.albany.edu
Wed Feb 3 10:44:34 PST 2010
On Wed, Feb 03, 2010 at 09:06:42AM -0800, Robin Sommer wrote:
> > core(I have 8) to split up the traffic. If it took any more I would just get
> > the better intel GigE card and do the traffic splitting in hardware.
>
> I know that the Intels are able to do that but I'm curious how
> actually set it up. Have you played that with? We're just getting
> some of Intel's 10G models ...
>
> Robin
I haven't played with it myself.. I thought the last box I got was going to
come with the newer igb cards, but it has an older e1000 based one.
There is a lot of information on it here:
http://www.ntop.org/TNAPI.html
I'm not sure if his patches are required to make it work, or just work faster..
the key bit seems to be:
# insmod ./<driver name>.ko IntMode=3 (IntMode=3 enables MSI-X)
"It's now time to start your multiqueue PF_RING application. Suppose you use
ethX with Y RX queues: you can either capture from ethX (aggregated traffic
from all RX queues) or from the single queues ethX at 0 ... ethX at Y-1. This means
that if you capture from the ethX device you capture from all queues (PF_RING
merges traffic from all incoming queues). Instead for maximum performance you
can create a multithreaded application which captures from the single queues."
--
-- Justin Azoff
-- Security & Network Performance Analyst
More information about the Bro
mailing list