[Oisf-users] Napatech support in Suricata: thread configuration and flow pinning

[Stefano Debenedetti]

hello,

I'm happy to see that 3rd generation drivers support for Napatech
cards is going to be in 1.4.

I am testing a NT20E2 In-Line card [1] and using Napatech's example
packet forwarding program I found out that the best performance is
achieved with 8 cores (0 packet drop with full-duplex 10G link fully
saturated at any packet size) but I have 32 cores on my test machine
so I would like to use the other 24 cores for packet decoding,
reassembly and detection.

I find Suricata's threading configuration a bit hard to understand,
could anybody please point me to an example of how to do this?

Another question: the card has its own hardware-based 5-tuple
bi-directional flow-pinning functionality that will make packets
from same flow stay on the same core, in a setup like what I
described above there would be another layer of flow-pinning made in
software by Suricata, right?

Thanks ciao
ste

[1]
http://www.napatech.com/products/in-line_adapters/2x10g_pcie_nt20e2.html