[Oisf-users] Performance on multiple CPUs

[Victor Julien]

On 08/15/2011 06:00 PM, Gene Albin wrote:
> Anoop,
>   Indeed.  With 48 CPU's in both runmodes in each max-pending-packets
> category I average the following across all of my runs:
> 
> Runmode: Auto
> MPP     Avg PPS   StDev
> 50:     27160     590
> 500:    29969     1629
> 5000:   31267     356
> 50000:  31608     358
> 
> Runmode: AutoFP
> MPP     Avg PPS   StDev
> 50:     16924     106
> 500:    56572     405
> 5000:   86683     1577
> 50000:  132936    5548
> 
> 
>   Just reading over my email I don't think I mentioned the variables that
> I'm adjusting.  3 variables here.  Runmode, Detect Thread Ratio, and Max
> Pending Packets.  Each run that I mention above is at a different DTR from
> .1-1.0 then 1.2, 1.5, 1.7, and 2.0.  I was expecting to see something along
> the lines of Eric LeBlond's results on his blog post:
> http://home.regit.org/2011/02/more-about-suricata-multithread-performance/
> but it doesn't look like changing the DTR gave me the significant
> performance increase that he reported.  (most likely due to other
> differences in our .yaml files, i.e. cpu_affinity).
> 
>   Thank you for the clarification on the relationship between MPP and the
> cache.  That does clear thing up a bit.  So you think I should be seeing
> better performance with 48 CPU's than I'm currently getting?  Where do you
> think I can make the improvements?  My first guess would be in cpu_affinity,
> but that's just a guess.

One limitation of the pcap file runmodes is that no matter how many
cores/threads you throw at it, we still have only a single file reading
thread that has to feed all the rest.

PF_RING live mode and soon the AF_PACKET fanout live mode allow you to
have many more packet readers. But only for live modes.

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------