[Oisf-users] PCI Cuda cards?

[Martin Holste]

Ok, thanks.  It sounds like you need to test on live traffic, probably via
a traffic generator to get a real feel for improvement.  I've found that to
be the case when testing rule set sizes:  Offline testing is not a very
good indicator of live traffic performance.


On Wed, Dec 12, 2012 at 1:24 PM, Anoop Saldanha <anoopsaldanha at gmail.com>wrote:

> On Thu, Dec 13, 2012 at 12:13 AM, Martin Holste <mcholste at gmail.com>
> wrote:
> >>2400 processors?  Wow.  So, the practical question:  When the K20 family
> >> comes out, will Suricata really be harnessing all of the stream
> processors?
> >> Specifically, will it actually be performing 2400+ content matches in
> >> parallel?
> >
>
> Currently testing a redesigned version of cuda on my box.  Have tested
> on 2 pcaps, the first pcap offering a 2% perf increase and the second
> one offering around 10% perf increase. Not very great, but It's still
> a basic version which needs to be improved.
>
> I have tried out with a buffer timeout(the time period over which we'd
> buffer packets and send it over to the gpu) ranging from 2ms - 20ms.
> The max I'm able to buffer with 2ms is around 10k packets, and with
> 20ms it's around 20k packets.  The nos may not be very meaningful,
> since it's traffic dependent, but yes in this case I was utilizing all
> of my cuda cores, but maybe not as efficiently as I'd want to.  Good
> performance can be obtained when I can run a huge no of threads, i.e.
> x no of threads per packet, where  x > 1, as opposed to the 1 thread
> per packet I have now.  Have tried running 8million threads on 10mb
> buffer and it performed 4x better than having just 1 thread per
> payload.  Would probably explore that next.
>
> The bottleneck I'm seeing is keeping a high inflow of packets and with
> pap file mode I have just 1 receive thread.  If I have a couple of
> receive threads, I can buffer a lot more packets for the same timeout
> values.  The only way to use multiple receive threads is reading from
> multiple pcap files, but that would need us to have separate flow hash
> tables, engine time handler per pcap.
>
> I can run it on the network with pfring or afp multi-rx threads, but I
> won't have a proper benchmark.
>
> >
> >
> > On Wed, Dec 12, 2012 at 12:12 PM, Anoop Saldanha <
> anoopsaldanha at gmail.com>
> > wrote:
> >>
> >> On Wed, Dec 12, 2012 at 5:34 AM, Matt <matt at somedamn.com> wrote:
> >> > Does anyone have any recommendations for graphics cards I can put in a
> >> > server chassis that will perform well with Suricata?  I'm looking at
> >> > this
> >> > one:
> >> >
> >> > http://www.newegg.com/Product/Product.aspx?Item=N82E16814500262
> >> >
> >> > Any experience to share?
> >> >
> >> > - Matt
> >> > _______________________________________________
> >> > Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> >> > Site: http://suricata-ids.org | Support:
> >> > http://suricata-ids.org/support/
> >> > List:
> >> > https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> >> > OISF: http://www.openinfosecfoundation.org/
> >>
> >> don't bother getting this.
> >>
> >> I'd suggest waiting for sometime.  Hoping to see a gk110 based geforce
> >> card.  Worth the wait if it comes out.
> >>
> >> You can run the quadro(way better than the card you suggested above)
> >> which you have till then.
> >>
> >> --
> >> Anoop Saldanha
> >> _______________________________________________
> >> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> >> Site: http://suricata-ids.org | Support:
> http://suricata-ids.org/support/
> >> List:
> https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> >> OISF: http://www.openinfosecfoundation.org/
> >
> >
>
>
>
> --
> Anoop Saldanha
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20121212/0f3dc31c/attachment-0002.html>