[Oisf-users] Using a bonded interface.

[Charles Devoe]

We currently put all of our monitoring interfaces into a bond.  For example em1 and em2 are bonded together for a single interface.   We then tell Suricata to use the bond.  We use af-packet

I am not sure how this will affect suricata and performance tuning.  Does this put all of the incoming packets on the same NUMA node?

Is it better to use individual interfaces or will there be no degradation for using the bond?
This message and attachments may contain confidential information. If it appears that this message was sent to you by mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly prohibited. Please notify the sender immediately and permanently delete the message and any attachments.

. . . . .
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20190116/8f5673b8/attachment.html>