[Oisf-users] Performance on multiple CPUs

[Gene Albin]

Victor,
  Thanks for the explanation.  So do I understand correctly that for reading
pcap files I'm limited to only a single packet reader thread?  So at some
point my performance bottleneck would become the packet reading thread,
regardless of where the pcap file is stored?  If that's the case I could
probably use tcpreplay to resend the traffic through the interface and
pfring (thought I haven't begun to work with pfring yet).

Gene

On Tue, Aug 23, 2011 at 1:44 AM, Victor Julien <victor at inliniac.net> wrote:

> On 08/22/2011 10:51 PM, Gene Albin wrote:
> > So in that case the I/O becomes the bottleneck?  I've tried to minimize
> disk
> > I/O by putting the pcap file into a ramdisk.  Not sure if that makes a
> > difference or not.  (seems to, though)
>
> Disk I/O is one limitation you may run into. Another is whether the
> single packet reader thread can distribute the workload over the other
> threads/cores fast enough. The best results wrt performance have been
> seen in the pfring live modes with multiple reader threads.
>
> Cheers,
> Victor
>
> --
> ---------------------------------------------
> Victor Julien
> http://www.inliniac.net/
> PGP: http://www.inliniac.net/victorjulien.asc
> ---------------------------------------------
>
>


-- 
Gene Albin
gene.albin at gmail.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20110825/920a43a1/attachment-0002.html>