IDS: Re: port bonding and taps

[Bennett Todd <bet () rahul net>]

2003-10-03T14:04:12 Sam f. Stover:
> I'd like to know where the overhead imposed by the bonding causes 
> packet drops.
Please keep an open mind, and make that "where and whether".

In my experience bonding's overhead was so negligible that I doubt
it would show up as a critical factor in any configuration.

Happily, tcpdump -s0 will capture a nice test file from wherever
you're planning on snorting, and tcpreplay makes it easy to blast it
back at your snorter. Set up N boxes, where N == twice the number of
taps you're going to support, and have 'em blast into the bonded
NICs over crossover cables, with tcpreplay. You can control the
playback speed, you know how many packets went out, so you can
subtract from how many were snorted to measure exactly how many were
dropped.

-Bennett

Attachment: _bin
Description: