<html><body><span style="font-family:Verdana; color:#000000; font-size:10pt;"><div>I've set it to 24, recompiled and it seems to be running ok, (as in it's handling 2Gbps worth of packets) but I'm unable to get the number of rings to report as anything but 1. Have I missed somthing or is trully not working correctly. I've run it based on on flow and as packet... still no go.<br><br>EV-SVR-006:~$ cat /proc/net/pf_ring/info <br>PF_RING Version : 4.6.0 ($Revision: exported$)<br>Ring slots : 32768<br>Slot version : 12<br>Capture TX : No [RX only]<br>IP Defragment : No<br>Transparent mode : Yes (mode 0)<br>Total rings : 1<br>Total plugins : 0<br><br>- josh<br><br>---<br><br>Date: 3/8/2011 -- 16:52:58 (uptime: 0d, 00h 03m 21s)<br>-------------------------------------------------------------------<br>Counter | TM Name | Value<br>-------------------------------------------------------------------<br><a href="http://decoder.pkts  ">decoder.pkts  </a>; | Decode1 | 16416387<br><a href="http://decoder.bytes  ">decoder.bytes  </a>; | Decode1 | 988040217<br>decoder.ipv4 | Decode1 | 16461043<br>decoder.ipv6 | Decode1 | 700<br><a href="http://decoder.ethernet  ">decoder.ethernet  </a>; | Decode1 | 16406387<br>decoder.raw | Decode1 | 0<br><a href="http://decoder.sll  ">decoder.sll  </a>; | Decode1 | 0<br><a href="http://decoder.tcp  ">decoder.tcp  </a>; | Decode1 | 16406097<br>decoder.udp | Decode1 | 1130<br>decoder.icmpv4 | Decode1 | 3<br>decoder.icmpv6 | Decode1 | 0<br>decoder.ppp | Decode1 | 0<br>decoder.pppoe | Decode1 | 0<br><a href="http://decoder.gre  ">decoder.gre  </a>; | Decode1 | 0<br>decoder.vlan | Decode1 | 0<br>decoder.avg_pkt_size | Decode1 | 60.012753<br><a href="http://decoder.max_pkt_size  ">decoder.max_pkt_size  </a>; | Decode1 | 382<br><a href="http://defrag.ipv4.fragments  ">defrag.ipv4.fragments  </a>; | Decode1 | 0<br><a href="http://defrag.ipv4.reassembled  ">defrag.ipv4.reassembled  </a>; | Decode1 | 0<br>defrag.ipv4.timeouts | Decode1 | 0<br><a href="http://defrag.ipv6.fragments  ">defrag.ipv6.fragments  </a>; | Decode1 | 0<br><a href="http://defrag.ipv6.reassembled  ">defrag.ipv6.reassembled  </a>; | Decode1 | 0<br>defrag.ipv6.timeouts | Decode1 | 0<br><a href="http://tcp.sessions  ">tcp.sessions  </a>; | Stream1 | 844100<br>tcp.ssn_memcap_drop | Stream1 | 0<br><a href="http://tcp.pseudo  ">tcp.pseudo  </a>; | Stream1 | 0<br><a href="http://tcp.segment_memcap_drop  ">tcp.segment_memcap_drop  </a>; | Stream1 | 0<br><a href="http://tcp.stream_depth_reached ">tcp.stream_depth_reached </a>; | Stream1 | 0<br><a href="http://detect.alert  ">detect.alert  </a>; | Detect | 24768<br><br>- Josh<br><br>On Tuesday, March 08, 2011 04:25:04 am Victor Julien wrote:<br>> -----BEGIN PGP SIGNED MESSAGE-----<br>> Hash: SHA1<br>> <br>> Thanks Luca, I guess we'll find out soon enough if ppl run into perf<br>> issues... I think we have results for 16 and 24 soon.<br>> <br>> Cheers,<br>> Victor<br>> <br>> On 03/08/2011 08:42 AM, Luca Deri wrote:<br>> > Victor<br>> > this is just a define you can increase. However note that clusters were<br>> > designed to handle a few apps, thus if you increase the value to a much<br>> > higher value, we better review the code and see if it is still efficient<br>> > enough for your purposes<br>> > <br>> > Regards Luca<br>> > <br>> > On Mar 7, 2011, at 9:49 PM, Victor Julien wrote:<br>> > <br>> > Thanks for figuring that out Will!<br>> > <br>> > Luca, can we have a higher (or no) limit? I keep hearing stories of ppl<br>> > with 24 cores :)<br>> > <br>> > Cheers,<br>> > Victor<br>> > <br>> > On 03/07/2011 07:28 PM, Will Metcalf wrote:<br>> >>>>> It seems that the maximum is 8 threads here. Not sure if that can be<br>> >>>>> set higher if the number of slots in pfring are increased. Anyone<br>> >>>>> try that?<br>> >>>> <br>> >>>> This value is hardset in kernel/linux/pf_ring.h<br>> >>>> <br>> >>>> #define CLUSTER_LEN 8<br>> >>>> <br>> >>>> Modify accordingly, maybe Luca would be kind enough to increase the<br>> >>>> default value?<br>> >>>> <br>> >>>> Regards,<br>> >>>> <br>> >>>> Will<br>> >>>> <br>> >>>>> On Mon, Mar 7, 2011 at 11:47 AM, Victor Julien <<a href="mailto:victor@inliniac.net">victor@inliniac.net</a>><br>> >>>>> wrote:<br>> >>>>> <br>> >>>>> On 03/07/2011 06:15 PM, Chris Wakelin wrote:<br>> >>>>>> On 28/02/11 20:23, Victor Julien wrote:<br>> >>>>>>> Hey guys,<br>> >>>>>>> <br>> >>>>>>> I know a couple of you are running PF_RING in a high speed<br>> >>>>>>> environment. The attached patch means to improve it's performance.<br>> >>>>>>> It adds a new option called "pfring.threads" that controls the<br>> >>>>>>> number of reader threads the pfring code uses. I've tested<br>> >>>>>>> (lightly) with 1, 4 and 8 which all worked fine. There are some<br>> >>>>>>> more improvements, including the removal of one memcpy per<br>> >>>>>>> packet...<br>> >>>>>> <br>> >>>>>> OK, giving it a go with 4 threads ...<br>> >>>>> <br>> >>>>> It seems that the maximum is 8 threads here. Not sure if that can be<br>> >>>>> set higher if the number of slots in pfring are increased. Anyone<br>> >>>>> try that?<br>> >>>>> <br>> >>>>> Cheers,<br>> >>>>> Victor<br>> >>>>> <br>> >>>>> <br>> >>>>> _______________________________________________<br>> >>>>> Oisf-users mailing list<br>> >>>>> <a href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a><br>> >>>>> <a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>> > <br>> > ---<br>> > Keep looking, don't settle - Steve Jobs<br>> <br>> - --<br>> - ---------------------------------------------<br>> Victor Julien<br>> <a href="http://www.inliniac.net">http://www.inliniac.net</a>/<br>> PGP: <a href="http://www.inliniac.net/victorjulien.asc">http://www.inliniac.net/victorjulien.asc</a><br>> - ---------------------------------------------<br>> <br>> -----BEGIN PGP SIGNATURE-----<br>> Version: GnuPG v1.4.10 (GNU/Linux)<br>> Comment: Using GnuPG with Mozilla - <a href="http://enigmail.mozdev.org">http://enigmail.mozdev.org</a>/<br>> <br>> iEYEARECAAYFAk119fAACgkQiSMBBAuniMf0vACfTb+qGwitelqoYNpn9QRqsb3Z<br>> hWQAnjWvWagt310OGdcIzV73clbC0SPB<br>> =zwNN<br>> -----END PGP SIGNATURE-----<br>> _______________________________________________<br>> Oisf-users mailing list<br>> <a href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a><br>> <a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br><br mce_bogus="1"></div></span></body></html>