Greetings, We have an existing libpcap application which analyzes http traffic. The application uses one sniffer thread per device, copies each packet, and then queues those packets for consumption by N worker threads. The architecture has served us well but we are encountering use cases where one sniffer thread per device is the clear bottleneck.
It seems clear to us that we would benefit from using PF_RING and may want to rewrite our application to use DNA+libzero. But before we start that effort, we'd like to take the baby step of recompiling our application with libpcap-1.1.1-ring and seeing what performance gains can be obtained. >From the documentation, it seems that we should be able to configure 4 RX queues, and then configure our application to sniff from those 4 queues as if they were different ethernet devices. And if the 10GigE device is eth2, the device names we would pass to libpcap would be eth2@0 .. eth2@3. Is that correct? Finally, I haven't seen exactly how one configures these 4 RX queues. Can someone please point me at the documentation for that configuration? Thanks.
_______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
