[Oisf-users] More cores versus higher speed cpus

[Peter Manev]

On 3 Apr 2020, at 22:18, Edgmand, Craig <craig.edgmand at okstate.edu> wrote:
> 
> I am using Intel X520 10Gb NICs.
> 
> I am moving away from PF_RING to AF_PACKET as well.

As long as you can stay equal or above 2.2,2.4GHz and need to monitor above 1Gb traffic -  I would say more cores.


> 
> 
> -----Original Message-----
> From: Oisf-users <oisf-users-bounces at lists.openinfosecfoundation.org> On Behalf Of Andreas Herz
> Sent: Friday, April 3, 2020 3:09 PM
> To: oisf-users at lists.openinfosecfoundation.org
> Subject: Re: [Oisf-users] More cores versus higher speed cpus
> 
> **External Email - Please verify sender email address before responding.**
> 
>> On 31/03/20 at 14:42, Edgmand, Craig wrote:
>>        I have 2 servers to run Suricata 5 on and given equal memory,
>>        disks speeds/capacity and Ethernet cards processing about 5
>>        Gb.  Would you recommend going with two 4 core processors
>>        running 3.3 Ghz or two 8 core processors running 2.20 Ghz? The
>>        slower processors have more mem cache (20 Mb vs 10 Mb).
> 
> What NICs do you use?
> 
> I would go with the 2x8 cores as just 2x4 cores could be a bottleneck when you see many flows. The advantage of the faster cores would help when you have many big flows and many rules.
> 
> There is no 100% correct answer.
> 
> --
> Andreas Herz
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsuricata-ids.org%2F&data=02%7C01%7Ccraig.edgmand%40okstate.edu%7Cbd67867a81c94ff9dbff08d7d80af4e6%7C2a69c91de8494e34a230cdf8b27e1964%7C0%7C0%7C637215413879372452&sdata=8ULjUnpU9Ur%2FreXOpqw%2BlFP%2FyDZpHFK3pa%2B6c%2BEVeOQ%3D&reserved=0 | Support: https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsuricata-ids.org%2Fsupport%2F&data=02%7C01%7Ccraig.edgmand%40okstate.edu%7Cbd67867a81c94ff9dbff08d7d80af4e6%7C2a69c91de8494e34a230cdf8b27e1964%7C0%7C0%7C637215413879382447&sdata=bAM%2FoQB82jFqx2DdG6fdiHpm%2BzN74bA0Uh75o%2BFVTs8%3D&reserved=0
> List: https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.openinfosecfoundation.org%2Fmailman%2Flistinfo%2Foisf-users&data=02%7C01%7Ccraig.edgmand%40okstate.edu%7Cbd67867a81c94ff9dbff08d7d80af4e6%7C2a69c91de8494e34a230cdf8b27e1964%7C0%7C0%7C637215413879382447&sdata=WHzRA9FsOei7wDBfqiFxUttMZ4M8G%2BLJJy3V6zT68XQ%3D&reserved=0
> 
> Conference: https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsuricon.net%2F&data=02%7C01%7Ccraig.edgmand%40okstate.edu%7Cbd67867a81c94ff9dbff08d7d80af4e6%7C2a69c91de8494e34a230cdf8b27e1964%7C0%7C0%7C637215413879382447&sdata=4pVyCi6oRi5LFa0MGJhoD1cl%2Fr36OJMFzbp1OC2i8RU%3D&reserved=0
> Trainings: https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsuricata-ids.org%2Ftraining%2F&data=02%7C01%7Ccraig.edgmand%40okstate.edu%7Cbd67867a81c94ff9dbff08d7d80af4e6%7C2a69c91de8494e34a230cdf8b27e1964%7C0%7C0%7C637215413879382447&sdata=oOCUF0UEZ78tEl11LtqtUF6WjdGt6m3BwnzVaZ1MB4M%3D&reserved=0
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> 
> Conference: https://suricon.net
> Trainings: https://suricata-ids.org/training/