[Oisf-devel] 77b708=WIN?

[Martin Holste]

Ah yes, I think you had to correct me on this before:

hash_pkt(hdr->extended_hdr.parsed_pkt.vlan_id,
                                          hdr->extended_hdr.parsed_pkt.l3_proto,
                                          mask_src ? ip_zero :
hdr->extended_hdr.parsed_pkt.ip_src,
                                          mask_dst ? ip_zero :
hdr->extended_hdr.parsed_pkt.ip_dst,
                                          mask_src ? 0 :
hdr->extended_hdr.parsed_pkt.l4_src_port,
                                          mask_dst ? 0 :
hdr->extended_hdr.parsed_pkt.l4_dst_port);


On Tue, Oct 4, 2011 at 1:17 PM, William Metcalf
<william.metcalf at gmail.com> wrote:
> Martin the hash in PF_RING afaik is vlan,proto,src,dst,sport,dport % number of cluster members.  However not somewhere that I can verify.
>
> Regards,
>
> Will
>
>
> On Oct 4, 2011, at 12:51 PM, Martin Holste <mcholste at gmail.com> wrote:
>
>> PF_RING does a simple hash on srcip/dstip, so if suri does any more
>> than that, it'll probably balance better.
>>
>> On Tue, Oct 4, 2011 at 12:47 PM, Victor Julien <victor at inliniac.net> wrote:
>>> On 10/04/2011 07:24 PM, Martin Holste wrote:
>>>> I recommend switching to autofp from single for PF_RING.
>>>
>>> This is interesting. In the "single" mode we rely on PF_RING to load
>>> balance the flows, right?
>>>
>>> In "autofp" mode, Suricata uses it's own loadbalancing mechanism. Does
>>> it appear that ours is balancing more evenly? Would be surprising
>>> considering how simple the hash is.
>>>
>>> Or are there other factors that I'm overlooking?
>>>
>>> Cheers,
>>> Victor
>>> --
>>> ---------------------------------------------
>>> Victor Julien
>>> http://www.inliniac.net/
>>> PGP: http://www.inliniac.net/victorjulien.asc
>>> ---------------------------------------------
>>>
>>> _______________________________________________
>>> Oisf-devel mailing list
>>> Oisf-devel at openinfosecfoundation.org
>>> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel
>>>
>> _______________________________________________
>> Oisf-devel mailing list
>> Oisf-devel at openinfosecfoundation.org
>> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel
>