[Discussion] Suricata performance over pcap

[Victor Julien]

On 01/14/2011 03:53 PM, Scott Damron wrote:
> You might want to check your CPU utilization.  I know using TNAPI with
> a 10 gig card and 16 cores I can reach 10Gbit on an Intel 10Gbit card.
>  Using the set_irq_affinity script to load balance it across all
> cores.  YMMV.

You can set the pcap recv thread's cpu affinity as well from Suricata's
suricata.yaml by enabling the thread.set_cpu_affinity option. This will
force the pcap thread to run on CPU0. A problem here may be that we run
a single pcap receive thread. Our current git master code allows you to
read from multiple pcap devices, but that has it's own set of, ehhh
"challenges" :)

Cheers,
Victor

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------