IDS mailing list archives
Re: port bonding and taps
From: "Sam f. Stover" <sstover () iwc sytexinc com>
Date: Fri, 3 Oct 2003 15:19:09 -0400
Please keep an open mind, and make that "where and whether".
My mind is quite open, thank you. The entire thrust of my interest is in to what degree does bonding affect sniffing. I understand completely that the possibilities range from having a large impact to zero impact.
In my experience bonding's overhead was so negligible that I doubt it would show up as a critical factor in any configuration.
This has not been my experience - nor does it make sense. Any additional work that needs to be done in a high bandwidth scenario can have a large impact on performance. For example, adding one poorly written signature in a low volume network can go by unnoticed. However, drop that same signature in a high bandwidth environment and your CPU utilization goes through the roof. It stands to reason that bonding *could* impose similar issues.
Happily, tcpdump -s0 will capture a nice test file from wherever you're planning on snorting, and tcpreplay makes it easy to blast it back at your snorter. Set up N boxes, where N == twice the number of taps you're going to support, and have 'em blast into the bonded NICs over crossover cables, with tcpreplay. You can control the playback speed, you know how many packets went out, so you can subtract from how many were snorted to measure exactly how many were dropped.
Yes, this is a nice scenario to test, but I'm also interested in hearing what people are seeing who actually use this in a real world environment.
____ S.f.Stover sstover () iwc sytexinc com
Attachment:
PGP.sig
Description:
Current thread:
- Re: port bonding and taps, (continued)
- Re: port bonding and taps Bamm Visscher (Oct 02)
- Re: port bonding and taps Jeffrey . Stebelton (Oct 02)
- Re: port bonding and taps Michael Stone (Oct 02)
- Re: port bonding and taps Sam f. Stover (Oct 02)
- Re: port bonding and taps Bamm Visscher (Oct 06)
- RE: port bonding and taps PPowenski (Oct 02)
- Re: port bonding and taps Sam f. Stover (Oct 02)
- Re: port bonding and taps Bennett Todd (Oct 06)
- Re: port bonding and taps Sam f. Stover (Oct 06)
- Re: port bonding and taps Bennett Todd (Oct 06)
- Re: port bonding and taps Sam f. Stover (Oct 06)
- Re: port bonding and taps Sam f. Stover (Oct 02)