[Bro] Core affinity on AMD Opteron 6276

[erik clark]

Ralph, you may want to look back at the archives. Michal and I think Justin
had posted an extensive discussion on how to identify and pin cpus. See:

http://mailman.icsi.berkeley.edu/pipermail/bro/2016-October/010743.html

The suggested lstopo is a very good way to enumerate your cores, as
indicated in that thread. :)

Also, regarding 32 workers, we are handling 6Gb/s traffic with af_packet
with just 18 workers, minimum memory usage, but fairly high rate of cpu
usage. Our drop rate is under .5% across all workers.

Lastly, read the Bro bit here:

https://www.sans.org/reading-room/whitepapers/intrusion/open-source-ids-high-performance-shootout-35772

We have found that this is indeed fairly accurate with regards to worker
count and pps consumption by bro.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20170112/5900120c/attachment.html