[Oisf-users] Possible to have DAG & PF_RING devices simultaneously?

[Victor Julien]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 06/02/2015 05:19 PM, Brian Keefer wrote:
> 
> On Jun 2, 2015, at 3:56 AM, Michał Purzyński
> <michalpurzynski1 at gmail.com> wrote:
> 
>> Note - I don't have any experience with DAG, I just know how it
>> works.
>> 
>> Specialised capture cards like Endace and Myricom allocate a
>> userspace buffer, push packets to it, and Suricata or other
>> applications can take packets from this buffer. Packets don't
>> cross the kernel (bypassing it for performance reasons). So they
>> should not be visible to pf_ring and DAG+pf_ring will not work.
>> 
>> An educated guess, at best.
>> 
> 
> Hello Michal,
> 
> I guess I didn’t explain the question very well.
> 
> I have a machine with 2 cards: A quad I350 Intel card, and a dual
> Endance card. Currently I have several 1Gb copper connections to
> the Intel card, which is setup with Suricata via PF_RING. I’m
> planning to connect the DAG to a 10Gb fiber feed. I’m wondering if
> the same Suricata instance can handle input from both
> simultaneously (still using PF_RING for the Intel card, but using
> DAG for the Endace card).

No you can't. Not much in the way technically, other than the setup of
our runmodes. But considering how rare such a setup is, I'm not
interested in spending resources on it :)

- -- 
- ---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
- ---------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBAgAGBQJVbc7uAAoJEMH0leOSaFa0190IAKqKiwHN5jLdLQph+t1sN5v5
bKWmL4fzRAKt9Ix+pj7J6WlYA2SJ42Ip6RBYTAAwzUpz62q09vI4JnefjsJtd93m
6qy/0f/vvBYVNqjT6k4FSohAsmFSsZCD9NtUA42l4j5y+YLvsoi2uBpN/0jkMZsw
NqayIWPXBEHhu81A46bzXeBhO05Qx3y+7/yVq67Fdkcl9hOaGouGbVg211WmNyt8
RuKlOVzl2KRwo/2m1BqPzGabWT25i1xmdlIjF49716EBahxiKTWOG/ESbhOEZPzL
JxUbNP18uRyHB04S+WdT+QdiCp8+9RgbMawU2O2cCe2CsUAMs0YdR4POioXZu5c=
=ouh1
-----END PGP SIGNATURE-----