[Oisf-users] Question about cpu-affinity

[Cooper F. Nelson]

On 3/4/2018 10:30 PM, Peter Manev wrote:
> I was just tackling a similar AMD based system and can confirm the
> same observations/findings.
> AMD does not seem to have the same caching architecture indeed.
The "secret ingredient" of the SEPTUN build is the DDIO feature, which
allows the Intel NICs to copy packets directly into the L3 cache. 

>> What I ended up doing was creating a hybrid deployment that used my standard
>> HPC server build, 4 RSS queues/cores per NIC/NUMA node and cluster_flow to
>> have suri distribute flows to the remaining 56 cores in software.  The
>> reason I wanted to interleave the detect threads was to leverage the AMD
>> Hypertransport bus to evenly distribute the load from both NICs over the
>> whole system.
> Seems like a good approach with the set up - is that with using the
> low entropy hash key?
Yes low entropy hash key, current kernel and bundled ixgbe driver.  In
general my build mission statement is to use a low-res timer (100hz),
virtual hugepages, IRQ coalescing and 4k/2mb blocks to move as much data
as possible per cpu 'tick'.  This allows better cache coherency per
process timeslice. 

>
>> --
>> Cooper Nelson
>> Network Security Analyst
>> UCSD ITS Security Team
>> cnelson at ucsd.edu x41042
>>
>
>

-- 
Cooper Nelson
Network Security Analyst
UCSD ITS Security Team
cnelson at ucsd.edu x41042


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20180304/f6c96bcf/attachment-0002.sig>