[Oisf-users] Napatech support in Suricata: thread configuration and flow pinning

[Victor Julien]

On 12/13/2012 05:36 PM, Matthew Keeler wrote:
> With 3GD in Suricata the threading configuration is done by Suricata. It
> uses the builtin auto, autofp or workers run modes with workers being
> the most efficient in my testing.
> 
> The built in workers run mode will use one thread per stream configured
> using NTPL. If you want 8 threads, then you should configure 8 streams.
> As for the flow pinning the Napatech card can do it or you can have it
> round robin packets to the individual streams. As for the flow pinning
> in Suricata, someone else can provide a more in depth answer on the subject.

Is it possible to have more streams? Say 16 or 32?

Cheers,
Victor


> 
> Matt Keeler
> nPulse Technologies, Inc./
> /
> mk at npulsetech.com <mailto:mk at npulsetech.com>
> 
> On Dec 13, 2012, at 11:16 AM, Stefano Debenedetti <ste at demaledetti.net
> <mailto:ste at demaledetti.net>> wrote:
> 
>> hello,
>>
>> I'm happy to see that 3rd generation drivers support for Napatech
>> cards is going to be in 1.4.
>>
>> I am testing a NT20E2 In-Line card [1] and using Napatech's example
>> packet forwarding program I found out that the best performance is
>> achieved with 8 cores (0 packet drop with full-duplex 10G link fully
>> saturated at any packet size) but I have 32 cores on my test machine
>> so I would like to use the other 24 cores for packet decoding,
>> reassembly and detection.
>>
>> I find Suricata's threading configuration a bit hard to understand,
>> could anybody please point me to an example of how to do this?
>>
>> Another question: the card has its own hardware-based 5-tuple
>> bi-directional flow-pinning functionality that will make packets
>> from same flow stay on the same core, in a setup like what I
>> described above there would be another layer of flow-pinning made in
>> software by Suricata, right?
>>
>> Thanks ciao
>> ste
>>
>> [1]
>> http://www.napatech.com/products/in-line_adapters/2x10g_pcie_nt20e2.html
>> _______________________________________________
>> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
>> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
>> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>> OISF: http://www.openinfosecfoundation.org/
> 
> --------------------------------------------------------------------
> The information contained herein is for the exclusive use of the original recipient.  This information is granted for limited distribution within the recipient's organization for planning purposes only.  Further dissemination, whether private or public, is prohibited and may be covered under a non-disclosure agreement.
> 
> 
> 
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> OISF: http://www.openinfosecfoundation.org/
> 


-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------