Measuring performance

[four]

http://www.metaflows.com/technology/10-gbps-pf_ring-2/

I've been reading your blog and following along at home. I have a
working snort multithreaded instance using the current SVN of PF_RING.
What I can't seem to figure out is how much traffic my instance is
handling.

I turned on the snort-stats preprocessor and was looking at the
snort.stats log but it's really crazy numbers that don't seem right
for pf_ring (dropping ~90% of packets per process? and each process is
handling 1.5 Mbps?!) Seems really wrong. So is there some way to
reliably determine the amount of throughput you are getting?

Thanks much for the blog posts!

0100

[livio]

The best way to measure pfring performance is to compare the RX PACKET
counts from the input interface
(or your generator) with the sum of all the Tot Packets counts in the
files /proc/net/pf_ring/*eth* with the same 'Cluster Id'
These proc files are dynamically created and deleted as new processes
are added or deleted to the PFring clusters.
Anything counted in Tot Packets is also processed by Snort.

It you are after performance, you need to use the Ethernet drivers
included in the PFRING tarball and
use transparent mode 1 when loading the drivers.