[Oisf-users] Napatech support in Suricata: thread configuration and flow pinning

[Matthew Keeler]

Just run suricata with --napatech and --runmode autofp.

To have some tuning of the number of detect threads you can play around with the detect-thread-ratio configuration item in the yaml file. 

Matt Keeler
nPulse Technologies, Inc.
mk at npulsetech.com



On Dec 14, 2012, at 7:51 AM, Stefano Debenedetti <ste at demaledetti.net> wrote:

>> Date: Thu, 13 Dec 2012 12:17:41 -0500
>> From: Matthew Keeler <mk at npulsetech.com>
>> To: Stefano Debenedetti <ste at demaledetti.net>
>> Cc: oisf-users at openinfosecfoundation.org
>> Subject: Re: [Oisf-users] Napatech support in Suricata: thread
>> 	configuration	and flow pinning
>> Message-ID: <1E5C9C1A-C3FA-4138-A1FE-6B308F3F9C0A at npulsetech.com>
>> Content-Type: text/plain; charset="us-ascii"
>> 
>> Yes, the autofp run mode is probably more in line with what you want. In that scenario it should still spawn 1 acquisition thread per stream, but the number of detect threads not be tied to it and should spawn many more threads.
> 
> 
> What would the configuration look like for achieving this?
> 
> 
> Thank you ciao
> ste
> 
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> OISF: http://www.openinfosecfoundation.org/


--------------------------------------------------------------------
The information contained herein is for the exclusive use of the original recipient.  This information is granted for limited distribution within the recipient's organization for planning purposes only.  Further dissemination, whether private or public, is prohibited and may be covered under a non-disclosure agreement.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20121214/c126017b/attachment-0002.html>