[Oisf-users] More cores versus higher speed cpus

[Andreas Herz]

On 31/03/20 at 14:42, Edgmand, Craig wrote:
>         I have 2 servers to run Suricata 5 on and given equal memory,
>         disks speeds/capacity and Ethernet cards processing about 5
>         Gb.  Would you recommend going with two 4 core processors
>         running 3.3 Ghz or two 8 core processors running 2.20 Ghz? The
>         slower processors have more mem cache (20 Mb vs 10 Mb).

What NICs do you use?

I would go with the 2x8 cores as just 2x4 cores could be a bottleneck
when you see many flows. The advantage of the faster cores would help
when you have many big flows and many rules.

There is no 100% correct answer.

-- 
Andreas Herz