Hello again all...
Replying to my own post!
--On 16 February 2010 12:11 +0000 Peter Bates <[email protected]> wrote:
Yes - this is part of my confusion, although I've read the PF_RING web
page and userguide - I'm still unsure as to the setting of 'Transparent
mode'
and whether I should be using a NIC driver patched for PF_RING or not.
Sorry - I didn't make this entirely clear - what I meant was
1) I'm still unclear as to the meaning of the different transparent modes
2) Whether or not I need to use the patched NIC kernel module
3) Whether mixing PF_RING aware applications with non-PF_RING aware
applications is a major performance problem.
Particularly with point 3 it looks like I need to be exploring how to SPAN
or
passively tap to multiple boxes if I need separate systems to run different
applications.
I guess this is the advantage of flow-based technologies - you collect the
data into a standard format and can then throw different applications at
the data - the disadvantage of course is that you're sampling the available
data and also not capturing contents (which isn't much use for something
like Snort!).
--
Peter Bates, Network Support & Development Officer
Goldsmiths, University of London
New Cross, London SE14 6NW. Telephone: 020 7919 7082
_______________________________________________
Ntop-misc mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
