[Oisf-users] Performance with 3x600Mbps and up to 10Gbps

[Victor Julien]

On 20-10-15 14:19, Jozef Mlích wrote:
>>> Our configuration is almost the default one for SELKS except:
>>> > >   - af-packet cluster_type=cluster_round_robin
>> >
>> >You'll really have to use cluster_flow instead (or cluster_cpu if you
>> >*really*  know what you're doing). The same thread needs to be fed
>> >packets from the same flow.
> I was playing also with cluster_flow and cluster_cpu types, but I
> haven't seen significant improvement. I was using mainly cluster_flow.
>
> The utilization of machine and throughput (number of drops) was better
> in one case with workers and cluster_round_robin cluster type.

The problem I was trying to highlight here is not performance, but 
accuracy. Any tcp & http tracking is at risk of failing due to the 
random packet distribution over the threads, while the code expects the 
one thread, one flow principle. You'll likely see many more stream 
events, and far fewer http and other logs.

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------