Re: Intel X520 and Multi-Queue Snort

[Will Metcalf <william.metcalf () gmail com>]

Mike,

Read up on TNAPI.  It is explicitly designed to do what you want I
think, as long as your card uses a TNAPI driver.  I realize this isn't
a "native" solution, but, I don't know of any, so....

http://www.ntop.org/TNAPI.html

Regards,

Will

On Thu, May 12, 2011 at 4:18 PM, Mike Lococo <mikelococo () gmail com> wrote:
> On 05/12/2011 05:00 PM, Martin Holste wrote:
> > PF_RING will work independently of the card, though it has extra
> > optimizations for specific models.
>
> Yeah, I am familiar with PFRING in broad-terms. What's interesting about
> the Intel X520 family of 10gig cards is that is they have multiple
> hardware-queues, which may or may not allow them to scale to
> higher-throughput than PFRING on other capture-hardware.
>
> I had also sort of expected (for no good reason, I suppose) that those
> hardware queues would be exposed by the native-drivers even without
> PFRING, similar to what happens with Endace-cards which have
> sub-interfaces (like dag0:0, dag0:1, dag0:2, etc) and provide tools to
> specify how traffic is distributed between them. So I'm hoping that
> someone with experience on this family of hardware will chime in to tell
> me that I'm missing something obvious.
>
> Unfortunately, what I'm starting to gather is that the native
> multi-queue features in linux might be an internal optimization to
> spread IRQ load among multiple processors, but that it still presents a
> single queue to userspace and can't be used for ids-type-load-balancing
> to multiple user-processes without a kernel-module like PFRING that adds
> in some extra glue to expose the multiple-queues to userspace.
>
> Cheers,
> Mike Lococo
>
> ------------------------------------------------------------------------------
> Achieve unprecedented app performance and reliability
> What every C/C++ and Fortran developer should know.
> Learn how Intel has extended the reach of its next-generation tools
> to help boost performance applications - inlcuding clusters.
> http://p.sf.net/sfu/intel-dev2devmay
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

------------------------------------------------------------------------------
Achieve unprecedented app performance and reliability
What every C/C++ and Fortran developer should know.
Learn how Intel has extended the reach of its next-generation tools
to help boost performance applications - inlcuding clusters.
http://p.sf.net/sfu/intel-dev2devmay
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users