[Oisf-users] Possible to have DAG & PF_RING devices simultaneously?

[Brian Keefer]

On Jun 2, 2015, at 3:56 AM, Michał Purzyński <michalpurzynski1 at gmail.com> wrote:

> Note - I don't have any experience with DAG, I just know how it works.
> 
> Specialised capture cards like Endace and Myricom allocate a userspace
> buffer, push packets to it, and Suricata or other applications can
> take packets from this buffer. Packets don't cross the kernel
> (bypassing it for performance reasons). So they should not be visible
> to pf_ring and DAG+pf_ring will not work.
> 
> An educated guess, at best.
> 

Hello Michal,

I guess I didn’t explain the question very well.

I have a machine with 2 cards: A quad I350 Intel card, and a dual Endance card. Currently I have several 1Gb copper connections to the Intel card, which is setup with Suricata via PF_RING. I’m planning to connect the DAG to a 10Gb fiber feed. I’m wondering if the same Suricata instance can handle input from both simultaneously (still using PF_RING for the Intel card, but using DAG for the Endace card).

—
bk
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 841 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20150602/dc75603f/attachment.sig>