[Oisf-users] PCI Cuda cards?

[Anoop Saldanha]

On Thu, Dec 13, 2012 at 12:13 AM, Martin Holste <mcholste at gmail.com> wrote:
>>2400 processors?  Wow.  So, the practical question:  When the K20 family
>> comes out, will Suricata really be harnessing all of the stream processors?
>> Specifically, will it actually be performing 2400+ content matches in
>> parallel?
>

Currently testing a redesigned version of cuda on my box.  Have tested
on 2 pcaps, the first pcap offering a 2% perf increase and the second
one offering around 10% perf increase. Not very great, but It's still
a basic version which needs to be improved.

I have tried out with a buffer timeout(the time period over which we'd
buffer packets and send it over to the gpu) ranging from 2ms - 20ms.
The max I'm able to buffer with 2ms is around 10k packets, and with
20ms it's around 20k packets.  The nos may not be very meaningful,
since it's traffic dependent, but yes in this case I was utilizing all
of my cuda cores, but maybe not as efficiently as I'd want to.  Good
performance can be obtained when I can run a huge no of threads, i.e.
x no of threads per packet, where  x > 1, as opposed to the 1 thread
per packet I have now.  Have tried running 8million threads on 10mb
buffer and it performed 4x better than having just 1 thread per
payload.  Would probably explore that next.

The bottleneck I'm seeing is keeping a high inflow of packets and with
pap file mode I have just 1 receive thread.  If I have a couple of
receive threads, I can buffer a lot more packets for the same timeout
values.  The only way to use multiple receive threads is reading from
multiple pcap files, but that would need us to have separate flow hash
tables, engine time handler per pcap.

I can run it on the network with pfring or afp multi-rx threads, but I
won't have a proper benchmark.

>
>
> On Wed, Dec 12, 2012 at 12:12 PM, Anoop Saldanha <anoopsaldanha at gmail.com>
> wrote:
>>
>> On Wed, Dec 12, 2012 at 5:34 AM, Matt <matt at somedamn.com> wrote:
>> > Does anyone have any recommendations for graphics cards I can put in a
>> > server chassis that will perform well with Suricata?  I'm looking at
>> > this
>> > one:
>> >
>> > http://www.newegg.com/Product/Product.aspx?Item=N82E16814500262
>> >
>> > Any experience to share?
>> >
>> > - Matt
>> > _______________________________________________
>> > Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
>> > Site: http://suricata-ids.org | Support:
>> > http://suricata-ids.org/support/
>> > List:
>> > https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>> > OISF: http://www.openinfosecfoundation.org/
>>
>> don't bother getting this.
>>
>> I'd suggest waiting for sometime.  Hoping to see a gk110 based geforce
>> card.  Worth the wait if it comes out.
>>
>> You can run the quadro(way better than the card you suggested above)
>> which you have till then.
>>
>> --
>> Anoop Saldanha
>> _______________________________________________
>> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
>> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
>> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>> OISF: http://www.openinfosecfoundation.org/
>
>



-- 
Anoop Saldanha