[Oisf-devel] ring-size & buffer-size in af-packet mode?

[Mahnaz Talebi]

Thanks for your replay.
Is this ring-size the size of NIC rx-ring size, that set by ethtool? or the
size of rx-ring that contain sk-buffs (socket buffer)?
I studied some code of suricata/src/source-af-packet.c and saw that
buffer-size is used by setsockopt() function to set tcp buffer size (that
its max size is limited by rmem_max). Af-packet is a layer2 socket, So is
it needed to use this buffer?



On Sat, Aug 2, 2014 at 8:47 PM, Peter Manev <petermanev at gmail.com> wrote:

> On Sat, Aug 2, 2014 at 7:52 AM, Mahnaz Talebi <mhnz.talebi at gmail.com>
> wrote:
> > Hi,
> > what is mean of ring-size in af-packet mode? Is it related to rx-ring or
> > socket buffer (which contain sk-buffs)? or it is related to new buffer
> that
> > created by suricata? How about buffer-size?
> > I'm confused about the meaning of their.
> >
> >
>
> Use ring-size on kernels bigger than 3.2 and when you use >1 threads.
> Basically it a s per thread packet buffer.
>
>
>
>
> --
> Regards,
> Peter Manev
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-devel/attachments/20140803/19d80161/attachment-0002.html>