[Oisf-users] Suricata on 8 cores, ~70K packets/sec

[Robert Vineyard]

On 02/15/2011 12:09 PM, Eric Leblond wrote:
> You may have a look at this post on my blog:
> 	http://home.regit.org/?p=438
> A git version of suricata is required for the fine tuning described in
> the page but you can also play with the threads multiplicator. On a eight
> core, you could try something lower like 0.25.

After reading your blog post, I'm wondering if perhaps Suricata is running
into the same kinds of issues that have plagued the much-delayed
multi-threaded Snort 3.0:

http://securitysauce.blogspot.com/2009/04/snort-30-beta-3-released.html

I'm not sure how much if any code in Suricata is shared with Snort, but I
found Marty's analysis here to be very enlightening.

--
[ Robert Vineyard | RHCE, Security+ ]    [ robert.vineyard at oit.gatech.edu  ]
[ Information Security Engineer III ]    [ 404.385.6900 | FAX 404.894.9548 ]
[Finding a needle in a haystack isn't hard when every straw is computerized]