Home page logo
/

snort logo Snort mailing list archives

Re: CPU Affinity
From: Livio Ricciulli <livio () metaflows com>
Date: Sun, 27 Jan 2013 11:54:50 -0800

I am not sure; I would think so... We have always used the pf_ring DAQ because we want to support inline also..
Livio.

On 1/26/2013 11:36 AM, Craig Merchant wrote:

Thanks, Livio... So, we use PF-RING with the DNA/Libzero drivers. But Snort uses the pcap DAQ to access the Libzero interfaces, not the pf_ring DAQ.

Does that make any difference?

Thanks.


C

*From:*Livio Ricciulli [mailto:livio () metaflows com]
*Sent:* Friday, January 25, 2013 10:05 PM
*To:* snort-users () lists sourceforge net
*Subject:* Re: [Snort-users] CPU Affinity

According to our empirical measurements using PF-RING (if that's what you are using), DON'T use CPU affinity; DON'T bind CPUs. Let the Linux scheduler do what it wishes.. The definite proof is to compare identical runs using different setups on your hardware, with your rules, with your traffic..
However, i would bet that what I recommended above will win..

Livio.
On 1/25/2013 1:59 PM, Craig Merchant wrote:

We have a Snort sensor that runs 28 instances. Their CPU utilization tends average between 25% and 95%+. I've read opinions both ways for setting CPU affinity. What are the benefits/drawbacks of setting CPU affinity?

Thx.


Craig




------------------------------------------------------------------------------
Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
MVPs and experts. ON SALE this month only -- learn more at:
http://p.sf.net/sfu/learnnow-d2d




_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net  <mailto:Snort-users () lists sourceforge net>
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
Please visithttp://blog.snort.org to stay current on all the latest Snort news!




--
Livio Ricciulli
MetaFlows Inc.
(408) 835-5005


------------------------------------------------------------------------------
Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
MVPs and experts. ON SALE this month only -- learn more at:
http://p.sf.net/sfu/learnnow-d2d


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!


--
Livio Ricciulli
MetaFlows Inc.
(408) 835-5005

------------------------------------------------------------------------------
Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
MVPs and experts. ON SALE this month only -- learn more at:
http://p.sf.net/sfu/learnnow-d2d
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]