<div dir="ltr">That is what the comma represents for the ixgbe arguments, it reflects the setting for each port of an intel card.<div><br></div><div>Thus, for a system with two cards and a total of four ports.... modprobe ixgbe RSS=16,16,16,16 would enable 16 queues for each port. MQ=1,1,1,1 means multi-queue for each port (default) FdirMode=3,3,3,3 means mode 3 for each port.</div>
<div><br></div><div>Unless I am horribly confused.</div><div><br></div><div>--TC</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Aug 21, 2013 at 10:11 AM, Tritium Cat <span dir="ltr"><<a href="mailto:tritium.cat@gmail.com" target="_blank">tritium.cat@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hello. Yes I am aware of that. You've not read the entire thread; I was using more than one card.<span class="HOEnZb"><font color="#888888"><div>
<br></div><div>--TC</div></font></span></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Aug 21, 2013 at 10:00 AM, <a href="mailto:vpiserchia@gmail.com" target="_blank">vpiserchia@gmail.com</a> <span dir="ltr"><<a href="mailto:vpiserchia@gmail.com" target="_blank">vpiserchia@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hello,<br>
<br>
Intel cards based on 82598/82599 can support up to 16 RSS queues only.<br>
<br>
for example read this:<br>
<br>
<a href="http://www.gossamer-threads.com/lists/ntop/misc/30009" target="_blank">http://www.gossamer-threads.com/lists/ntop/misc/30009</a><br>
<br>
regards<br>
<span><font color="#888888">-v<br>
</font></span><div><div><br>
On 08/21/2013 06:52 PM, Tritium Cat wrote:<br>
> No, it doesn't work, at least in the sense of only 1% packet loss being considered a success. Something odd with the Intel cards is preventing more than 16 hardware queues from being used as the system will only show activity with 16 cores in workers mode, all other CPUs are 100% idle. The RSS parameter to the ixgbe module needs to be set for each port although it claims to automatically use # of cores or # of ports, whichever is greater. Also again, about FdirMode=3.. I don't think it applies here.<br>
><br>
> I've since removed the additional cards and just experiment with one. autofp mode isn't working as I'd expect either.<br>
><br>
> Adjusting the MTU did reduce memory consumption. I suppose that is meant to reflect the average pMTU of flows and not the link connected to the sensor. The documentation could be written better to reflect this as that part seems to imply something different. (yes, reading more about MTU and IDS from various sources makes it clear). Regarding documentation the af-packet section regarding the zero-copy ring size conflicting with buffer_size should be updated; values that are commented out are assumed to be 'defaults' like in many other configuration scenarios; I'm glad you pointed this out as it is definitely not apparent to me from just looking at the configuration.<br>
><br>
> I'm going to go away now to read code and experiment more.<br>
><br>
> --TC<br>
><br>
><br>
> autofp Example:<br>
><br>
> capture.kernel_packets | RxAFPeth41 | 7117283101<br>
> capture.kernel_drops | RxAFPeth41 | 4885784393<br>
> capture.kernel_packets | RxAFPeth42 | 7290835993<br>
> capture.kernel_drops | RxAFPeth42 | 5061427961<br>
> capture.kernel_packets | RxAFPeth43 | 7213432976<br>
> capture.kernel_drops | RxAFPeth43 | 4941736439<br>
> capture.kernel_packets | RxAFPeth44 | <a href="tel:7273721753" value="+17273721753" target="_blank">7273721753</a><br>
> capture.kernel_drops | RxAFPeth44 | <a href="tel:5046375696" value="+15046375696" target="_blank">5046375696</a><br>
> capture.kernel_packets | RxAFPeth45 | <a href="tel:7702660203" value="+17702660203" target="_blank">7702660203</a><br>
> capture.kernel_drops | RxAFPeth45 | 5473406098<br>
> capture.kernel_packets | RxAFPeth46 | 6526210366<br>
> capture.kernel_drops | RxAFPeth46 | 4280571057<br>
> capture.kernel_packets | RxAFPeth47 | <a href="tel:7473635100" value="+17473635100" target="_blank">7473635100</a><br>
> capture.kernel_drops | RxAFPeth47 | 5264888903<br>
> capture.kernel_packets | RxAFPeth48 | 8001217687<br>
> capture.kernel_drops | RxAFPeth48 | 5781338601<br>
> capture.kernel_packets | RxAFPeth49 | 7935510106<br>
> capture.kernel_drops | RxAFPeth49 | 5684606164<br>
> capture.kernel_packets | RxAFPeth410 | <a href="tel:6672471328" value="+16672471328" target="_blank">6672471328</a><br>
> capture.kernel_drops | RxAFPeth410 | 4480440331<br>
> capture.kernel_packets | RxAFPeth411 | <a href="tel:4012330752" value="+14012330752" target="_blank">4012330752</a><br>
> capture.kernel_drops | RxAFPeth411 | 2650530005<br>
> capture.kernel_packets | RxAFPeth412 | 6938284654<br>
> capture.kernel_drops | RxAFPeth412 | 4686886437<br>
> capture.kernel_packets | RxAFPeth413 | 7368646714<br>
> capture.kernel_drops | RxAFPeth413 | 5117305059<br>
> capture.kernel_packets | RxAFPeth414 | 5284771030<br>
> capture.kernel_drops | RxAFPeth414 | 3751148947<br>
> capture.kernel_packets | RxAFPeth415 | 7373582300<br>
> capture.kernel_drops | RxAFPeth415 | <a href="tel:5176332364" value="+15176332364" target="_blank">5176332364</a><br>
> capture.kernel_packets | RxAFPeth416 | 7114510564<br>
> capture.kernel_drops | RxAFPeth416 | 4903112771<br>
> capture.kernel_packets | RxAFPeth417 | 68112<br>
> capture.kernel_drops | RxAFPeth417 | 0<br>
> capture.kernel_packets | RxAFPeth418 | 80839<br>
> capture.kernel_drops | RxAFPeth418 | 0<br>
> capture.kernel_packets | RxAFPeth419 | 77292<br>
> capture.kernel_drops | RxAFPeth419 | 0<br>
> capture.kernel_packets | RxAFPeth420 | 90287<br>
> capture.kernel_drops | RxAFPeth420 | 0<br>
> capture.kernel_packets | RxAFPeth421 | 78012<br>
> capture.kernel_drops | RxAFPeth421 | 0<br>
> capture.kernel_packets | RxAFPeth422 | 74278<br>
> capture.kernel_drops | RxAFPeth422 | 0<br>
> capture.kernel_packets | RxAFPeth423 | 79919<br>
> capture.kernel_drops | RxAFPeth423 | 0<br>
> capture.kernel_packets | RxAFPeth424 | 84155<br>
> capture.kernel_drops | RxAFPeth424 | 0<br>
> capture.kernel_packets | RxAFPeth425 | 84760<br>
> capture.kernel_drops | RxAFPeth425 | 0<br>
> capture.kernel_packets | RxAFPeth426 | 85328<br>
> capture.kernel_drops | RxAFPeth426 | 0<br>
> capture.kernel_packets | RxAFPeth427 | 81765<br>
> capture.kernel_drops | RxAFPeth427 | 0<br>
> capture.kernel_packets | RxAFPeth428 | 83583<br>
> capture.kernel_drops | RxAFPeth428 | 0<br>
> capture.kernel_packets | RxAFPeth429 | 91101<br>
> capture.kernel_drops | RxAFPeth429 | 0<br>
> capture.kernel_packets | RxAFPeth430 | 104013<br>
> capture.kernel_drops | RxAFPeth430 | 0<br>
> capture.kernel_packets | RxAFPeth431 | 92905<br>
> capture.kernel_drops | RxAFPeth431 | 0<br>
> capture.kernel_packets | RxAFPeth432 | 98068<br>
> capture.kernel_drops | RxAFPeth432 | 0<br>
><br>
><br>
><br>
</div></div><div>> On Sun, Aug 18, 2013 at 10:43 PM, Cooper F. Nelson <<a href="mailto:cnelson@ucsd.edu" target="_blank">cnelson@ucsd.edu</a> <mailto:<a href="mailto:cnelson@ucsd.edu" target="_blank">cnelson@ucsd.edu</a>>> wrote:<br>
><br>
> No problem and please let us know if the 'worker' mode config works for<br>
> you. I'm planning on building a 40gig sensor and it would help if I<br>
> knew how it performed with multiple NICs.<br>
><br>
</div><div>> -Coop<br>
><br>
> On 8/16/2013 5:36 PM, Tritium Cat wrote:<br>
>> Cooper,<br>
><br>
>> Thanks again for the explanations and supporting information.<br>
><br>
>> --TC<br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
</div><div><div>> _______________________________________________<br>
> Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundation.org</a><br>
> Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br>
> List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
> OISF: <a href="http://www.openinfosecfoundation.org/" target="_blank">http://www.openinfosecfoundation.org/</a><br>
><br>
<br>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>