[Oisf-users] Performance with 3x600Mbps and up to 10Gbps

Victor Julien lists at inliniac.net
Tue Oct 20 13:25:21 UTC 2015

On 20-10-15 14:19, Jozef MlĂ­ch wrote:
>>> Our configuration is almost the default one for SELKS except:
>>> > >   - af-packet cluster_type=cluster_round_robin
>> >
>> >You'll really have to use cluster_flow instead (or cluster_cpu if you
>> >*really*  know what you're doing). The same thread needs to be fed
>> >packets from the same flow.
> I was playing also with cluster_flow and cluster_cpu types, but I
> haven't seen significant improvement. I was using mainly cluster_flow.
> The utilization of machine and throughput (number of drops) was better
> in one case with workers and cluster_round_robin cluster type.

The problem I was trying to highlight here is not performance, but 
accuracy. Any tcp & http tracking is at risk of failing due to the 
random packet distribution over the threads, while the code expects the 
one thread, one flow principle. You'll likely see many more stream 
events, and far fewer http and other logs.

Victor Julien
PGP: http://www.inliniac.net/victorjulien.asc

More information about the Oisf-users mailing list