[Oisf-devel] 77b708=WIN?

[William Metcalf]

Martin the hash in PF_RING afaik is vlan,proto,src,dst,sport,dport % number of cluster members.  However not somewhere that I can verify.

Regards,

Will


On Oct 4, 2011, at 12:51 PM, Martin Holste <mcholste at gmail.com> wrote:

> PF_RING does a simple hash on srcip/dstip, so if suri does any more
> than that, it'll probably balance better.
> 
> On Tue, Oct 4, 2011 at 12:47 PM, Victor Julien <victor at inliniac.net> wrote:
>> On 10/04/2011 07:24 PM, Martin Holste wrote:
>>> I recommend switching to autofp from single for PF_RING.
>> 
>> This is interesting. In the "single" mode we rely on PF_RING to load
>> balance the flows, right?
>> 
>> In "autofp" mode, Suricata uses it's own loadbalancing mechanism. Does
>> it appear that ours is balancing more evenly? Would be surprising
>> considering how simple the hash is.
>> 
>> Or are there other factors that I'm overlooking?
>> 
>> Cheers,
>> Victor
>> --
>> ---------------------------------------------
>> Victor Julien
>> http://www.inliniac.net/
>> PGP: http://www.inliniac.net/victorjulien.asc
>> ---------------------------------------------
>> 
>> _______________________________________________
>> Oisf-devel mailing list
>> Oisf-devel at openinfosecfoundation.org
>> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel
>> 
> _______________________________________________
> Oisf-devel mailing list
> Oisf-devel at openinfosecfoundation.org
> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel