Michal please see inline On Apr 23, 2013, at 1:36 PM, Michal Purzynski <[email protected]> wrote:
> Hi, > > what are your recommendation for transparent_mode when I have applications > both using pf_ring (bro, snort, nprobe) and a single one that does not > (netsniff-ng)? Mode 1. > > Should I run it with mode 1? My understanding is, the overhead should be > bigger here, because we have like two paths for data copying running at the > same time. Or does the shortcut, made by mode 1 for pf_ring applications work > so well that it's still better than just using NAPI for everything? You don't have additional copies, thus no additional overhead, but the difference is minimal in this case, you can use mode 0 or 1. > I guess, there's a reason you implemented "something in the middle" - i.e. > mode 1, just curious. Mode 1 reduces a bit the path, nothing special. Alfredo > > Unfortunately, I cannot (yet) run a full DNA, but working on it ;) Will have > to hack the netsniff-ng to add a pf_ring support. > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
