<div dir="ltr"><font face="arial, helvetica, sans-serif">Ok, so word back from RH is that hashing is not likely to be in RHEL anytime soon. They mentioned this as a possible alternative:</font><div><font face="arial, helvetica, sans-serif"><br></font></div><div><font face="arial, helvetica, sans-serif"><span style="color:rgb(51,51,51);white-space:pre-wrap">ethtool -K <ingress nic> rxhash off</span><br></font></div><div><span style="color:rgb(51,51,51);white-space:pre-wrap"><font face="arial, helvetica, sans-serif"><br></font></span></div><div><font face="arial, helvetica, sans-serif"><span style="color:rgb(51,51,51);white-space:pre-wrap">They mentioned that there would be a </span><span style="color:rgb(51,51,51);white-space:pre-wrap">performance penalty as the kernel will compute hashes for each skb on ingress, bit it is unlikely to be that noticeable.</span></font></div><div><font face="arial, helvetica, sans-serif"><span style="color:rgb(51,51,51);white-space:pre-wrap"><br></span></font></div><div><font face="arial, helvetica, sans-serif"><span style="color:rgb(51,51,51);white-space:pre-wrap">IMO, I think specifying a symmetric hash with -X might be preferential to turning rxhash off entirely, when dealing with af_packet in rhel7. Suggestions?</span></font></div><div><font face="arial, helvetica, sans-serif"><span style="color:rgb(51,51,51);white-space:pre-wrap"><br></span></font></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Jan 30, 2017 at 5:11 PM, Michał Purzyński <span dir="ltr"><<a href="mailto:michalpurzynski1@gmail.com" target="_blank">michalpurzynski1@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><a href="http://git.kernel.org/cgit/linux/kernel/git/davem/net-next.git/commit/?id=eb70db8756717b90c01ccc765fdefc4dd969fc74" target="_blank">http://git.kernel.org/cgit/<wbr>linux/kernel/git/davem/net-<wbr>next.git/commit/?id=<wbr>eb70db8756717b90c01ccc765fdefc<wbr>4dd969fc74</a><br><div><br></div><div>The whole thread is here - <a href="https://bro-tracker.atlassian.net/browse/BIT-1575" target="_blank">https://bro-tracker.<wbr>atlassian.net/browse/BIT-1575</a></div><div><br></div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Jan 30, 2017 at 4:48 AM, erik clark <span dir="ltr"><<a href="mailto:philosnef@gmail.com" target="_blank">philosnef@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">What commit was that Michal? I am being asked which it is.</div><div class="m_-5396521604648892672HOEnZb"><div class="m_-5396521604648892672h5"><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jan 26, 2017 at 11:31 AM, Michał Purzyński <span dir="ltr"><<a href="mailto:michalpurzynski1@gmail.com" target="_blank">michalpurzynski1@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">How about fixing the hash calculations, a patch that went upstream in the late 4.4<br>
<span><br>
> On Jan 26, 2017, at 7:35 AM, erik clark <<a href="mailto:philosnef@gmail.com" target="_blank">philosnef@gmail.com</a>> wrote:<br>
><br>
> Cooper, just to followup. RedHat has confirmed that tpacket_v3 commits are in the 3.10 branch of RHEL7. They report it as being better supported in the 4 kernel line, but it is indeed supported though. If you are aware of specific commits for tpacket that you would like to see, pass them on and we can get them into 7.4 probably.<br>
</span>> ______________________________<wbr>_________________<br>
> Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundati<wbr>on.org</a><br>
> Site: <a href="http://suricata-ids.org" rel="noreferrer" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" rel="noreferrer" target="_blank">http://suricata-ids.org/suppor<wbr>t/</a><br>
> List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" target="_blank">https://lists.openinfosecfound<wbr>ation.org/mailman/listinfo/ois<wbr>f-users</a><br>
</blockquote></div><br></div>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>