[Oisf-users] af_packet and rss queue count

[erik clark]

I have seen several places commenting that you should set the RSS queue to
1. However, when examining af_packet with Bro, a patch released from Redhat
for the ixgbe kernel module, and some ethtool tweaking, we have found that
(for Bro at least) running a full 63 (we have 54 cores) RSS queues vastly
improves performance, and keeps state intact across sessions.

Based on this update, which fixes the broken implementation of setting a
symmetric hash in the hardware of the card (again ixgbe, not tested with
i40e), is it still necessary to run one queue? If so, you can't run Bro and
Suri on the same box with af_packet and get equivalent performance out of
both tools. Having run Suri with 63 queues for a week now, it seems
performance is considerably better than with pf_ring, and I can not find
any unusual behavior in my alerts...
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20161224/a96dd445/attachment.html>