[Oisf-devel] [RFC] af-packet fanout configuration

[Eric Leblond]

Hello,

Le mardi 09 août 2011 à 18:08 -0500, Martin Holste a écrit :
> I'm assuming the primary advantage in AF_PACKET is its inline
> capabilities, is that correct? 

I don't see how it could be used in inline mode. This is just a socket
like the one used by pcap. But I did not look in the details of all
options.

>  Or are there other efficiencies that
> make AF_PACKET superior to native PF_RING?

One of the main future advantage is that AF_PACKET is mainline. There is
also a patch by David Miller which add the capability to have multiple
socket sharing the packets coming from a single interface.

BR,
--
Eric Leblond
> 
> On Tue, Aug 9, 2011 at 6:01 PM, Eric Leblond <eric at regit.org> wrote:
> > Hello everyone,
> >
> > After looking at PF_RING code, I've decide to do the same for AF_PACKET
> > support.
> >
> > Best regards,
> >
> > Le lundi 08 août 2011 à 17:58 +0200, Eric Leblond a écrit :
> >> Hello,
> >>
> >> I'm currently working on af-packet support following the  patches
> >> proposed by David Miller to support multiple threads reading on the same
> >> interface (similar to PF_RING cluster). Basic af-packet support is now
> >> working and I will now add support for this feature called fanout.
> >>
> >> I hesitate on the configuration part: PF_RING uses a pfring.threads
> >> variable that is used to set the number of threads. pf_ring has
> >> integrated support of the multi-thread feature but this is not the case
> >> for af-packet. We will then have in fanout mode real suricata managed
> >> threads. Thus this could be useful to manage and tune them via the
> >> thread affinity setup.
> >>
> >> I propose the following:
> >>       * af-packet.fanout: activation of fanout/multithread support
> >>       * af-packet.threads: set the number of threads
> >> If set_cpu_affinity is set to yes:
> >>       * cpu_affinity.receive_cpu_set.threads is used to set the number
> >>         of threads
> >>       * if cpu_affinity.receive_cpu_set.threads and af-packet.threads
> >>         disagree a warning is loggued.
> >>
> >> What do you think ?
> >>
> >> BR,
> >> --
> >> Eric Leblond
> >> _______________________________________________
> >> Oisf-devel mailing list
> >> Oisf-devel at openinfosecfoundation.org
> >> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel
> >
> >
> > _______________________________________________
> > Oisf-devel mailing list
> > Oisf-devel at openinfosecfoundation.org
> > http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel
> >
> >

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 190 bytes
Desc: This is a digitally signed message part
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-devel/attachments/20110810/69c46851/attachment.sig>