[Oisf-devel] ring-size & buffer-size in af-packet mode?

[Peter Manev]

On Sun, Aug 3, 2014 at 6:19 AM, Mahnaz Talebi <mhnz.talebi at gmail.com> wrote:
> Thanks for your replay.
> Is this ring-size the size of NIC rx-ring size, that set by ethtool?

This is separately configurable per thread buffer when Suricata is
running in af_packet mode - nothing to do with the ring-size that is
set for the NIC by ethtool.

> or the
> size of rx-ring that contain sk-buffs (socket buffer)?
> I studied some code of suricata/src/source-af-packet.c and saw that
> buffer-size is used by setsockopt() function to set tcp buffer size (that
> its max size is limited by rmem_max). Af-packet is a layer2 socket, So is it
> needed to use this buffer?
>
>
>
> On Sat, Aug 2, 2014 at 8:47 PM, Peter Manev <petermanev at gmail.com> wrote:
>>
>> On Sat, Aug 2, 2014 at 7:52 AM, Mahnaz Talebi <mhnz.talebi at gmail.com>
>> wrote:
>> > Hi,
>> > what is mean of ring-size in af-packet mode? Is it related to rx-ring or
>> > socket buffer (which contain sk-buffs)? or it is related to new buffer
>> > that
>> > created by suricata? How about buffer-size?
>> > I'm confused about the meaning of their.
>> >
>> >
>>
>> Use ring-size on kernels bigger than 3.2 and when you use >1 threads.
>> Basically it a s per thread packet buffer.
>>
>>
>>
>>
>> --
>> Regards,
>> Peter Manev
>
>



-- 
Regards,
Peter Manev