Snort mailing list archives
Re: Intel X520 and Multi-Queue Snort
From: Mike Lococo <mikelococo () gmail com>
Date: Thu, 12 May 2011 17:18:32 -0400
On 05/12/2011 05:00 PM, Martin Holste wrote:
PF_RING will work independently of the card, though it has extra optimizations for specific models.
Yeah, I am familiar with PFRING in broad-terms. What's interesting about the Intel X520 family of 10gig cards is that is they have multiple hardware-queues, which may or may not allow them to scale to higher-throughput than PFRING on other capture-hardware. I had also sort of expected (for no good reason, I suppose) that those hardware queues would be exposed by the native-drivers even without PFRING, similar to what happens with Endace-cards which have sub-interfaces (like dag0:0, dag0:1, dag0:2, etc) and provide tools to specify how traffic is distributed between them. So I'm hoping that someone with experience on this family of hardware will chime in to tell me that I'm missing something obvious. Unfortunately, what I'm starting to gather is that the native multi-queue features in linux might be an internal optimization to spread IRQ load among multiple processors, but that it still presents a single queue to userspace and can't be used for ids-type-load-balancing to multiple user-processes without a kernel-module like PFRING that adds in some extra glue to expose the multiple-queues to userspace. Cheers, Mike Lococo ------------------------------------------------------------------------------ Achieve unprecedented app performance and reliability What every C/C++ and Fortran developer should know. Learn how Intel has extended the reach of its next-generation tools to help boost performance applications - inlcuding clusters. http://p.sf.net/sfu/intel-dev2devmay _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Intel X520 and Multi-Queue Snort Mike Lococo (May 12)
- Re: Intel X520 and Multi-Queue Snort Martin Holste (May 12)
- Re: Intel X520 and Multi-Queue Snort Mike Lococo (May 12)
- Re: Intel X520 and Multi-Queue Snort Will Metcalf (May 12)
- Re: Intel X520 and Multi-Queue Snort Mike Lococo (May 12)
- Re: Intel X520 and Multi-Queue Snort Martin Holste (May 13)
- Re: Intel X520 and Multi-Queue Snort Mike Lococo (May 13)
- Re: Intel X520 and Multi-Queue Snort Martin Holste (May 13)
- Re: Intel X520 and Multi-Queue Snort Mike Lococo (May 13)
- Re: Intel X520 and Multi-Queue Snort beenph (May 13)
- Re: Intel X520 and Multi-Queue Snort Mike Lococo (May 13)
- Re: Intel X520 and Multi-Queue Snort beenph (May 13)
- Re: Intel X520 and Multi-Queue Snort Martin Holste (May 13)
- Re: Intel X520 and Multi-Queue Snort Mike Lococo (May 12)
- Re: Intel X520 and Multi-Queue Snort Martin Holste (May 12)