Account Options

  1. Sign in
The old Google Groups will be going away soon, but your browser is incompatible with the new version.
Google Groups Home
« Groups Home
Metaflows
Home
+ new post
About this group
Join this group
Message from discussion Measuring performance
The group you are posting to is a Usenet group. Messages posted to this group will make your email address visible to anyone on the Internet.
Your reply message has not been sent.
Your post was successful
 
From:
To:
Cc:
Followup To:
Add Cc | Add Followup-to | Edit Subject
Subject:
Validation:
For verification purposes please type the characters you see in the picture below or the numbers you hear by clicking the accessibility icon. Listen and type the numbers you hear
 
livio  
View profile  
 More options Feb 23 2012, 9:44 pm
From: livio <lricciu...@gmail.com>
Date: Thu, 23 Feb 2012 18:44:01 -0800 (PST)
Local: Thurs, Feb 23 2012 9:44 pm
Subject: Re: Measuring performance
Print | View thread | Show original | Report this message | Find messages by this author
The best way to measure pfring performance is to compare the RX PACKET
counts from the input interface
(or your generator) with the sum of all the Tot Packets counts in the
files /proc/net/pf_ring/*eth* with the same 'Cluster Id'
These proc files are dynamically created and deleted as new processes
are added or deleted to the PFring clusters.
Anything counted in Tot Packets is also processed by Snort.

It you are after performance, you need to use the Ethernet drivers
included in the PFRING tarball and
use transparent mode 1 when loading the drivers.

On Feb 23, 4:55 pm, four <sur...@gmail.com> wrote:

> http://www.metaflows.com/technology/10-gbps-pf_ring-2/

> I've been reading your blog and following along at home. I have a
> working snort multithreaded instance using the current SVN of PF_RING.
> What I can't seem to figure out is how much traffic my instance is
> handling.

> I turned on the snort-stats preprocessor and was looking at the
> snort.stats log but it's really crazy numbers that don't seem right
> for pf_ring (dropping ~90% of packets per process? and each process is
> handling 1.5 Mbps?!) Seems really wrong. So is there some way to
> reliably determine the amount of throughput you are getting?

> Thanks much for the blog posts!

> 0100


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
Create a group - Google Groups - Google Home - Terms of Service - Privacy Policy
©2013 Google