Scott are you also using the same pf_ring version? (looking for differences first of all)
Alfredo On Jul 18, 2013, at 3:30 AM, Scott Finlon <[email protected]> wrote: > Alfredo, > At first I was using a slightly different config because I was utilizing 16 > threads instead of 8, but when I turned off hyper threading i went back to > using the exact same config. > PF_RING with the DNA DAQ, 8 queues, identical traffic, right now in the > summer with no students on campus we are only seeing a few hundred Mbps so > the older box is at 10ish % CPU utilization while the new box is at 100%. > > Is there any config you would like to see specifically? > > Thank you! > -Scott > > > On Jul 17, 2013, at 4:19 PM, "Alfredo Cardigliano" <[email protected]> > wrote: > >> Hi Scott >> are you using the same configuration on the two boxes? could you provide >> more details about configuration? >> >> Best Regards >> Alfredo >> >> On Jul 17, 2013, at 9:31 PM, Scott Finlon <[email protected]> wrote: >> >>> Yes, both MSI-X and PCIE v3 are supported. >>> I disabled HT because that is one of the only differences between the two >>> boxes, the old machine has two E5-2609's which aren't HT capable, and the >>> new machine has two E5-2660's which are. >>> >>> Scott Finlon, CISSP GCIA >>> ----------------------------------- >>> Information Security Engineer >>> The University of Scranton >>> email : [email protected] >>> phone : 570-941-6168 >>> ----------------------------------- >>> >>> >>> >>> >>> >>> >>> On 7/17/13 3:20 PM, "Ritter, Nicholas" <[email protected]> >>> wrote: >>> >>>> Does the new box support MSI-X and/or PCIe v3? I would think that >>>> disabling HT (as in HyperThreading) would be the last thing you would >>>> want to do. >>>> >>>> >>>> ________________________________________ >>>> From: [email protected] >>>> [[email protected]] on behalf of Scott Finlon >>>> [[email protected]] >>>> Sent: Wednesday, July 17, 2013 1:52 PM >>>> To: [email protected] >>>> Subject: [Ntop-misc] PF_RING / DNA + Snort >>>> >>>> I am in the process of moving Snort from an older box to a new box. Both >>>> are RHEL 6 x64, both with the same NICs. >>>> I am using PF_RING/DNA to split traffic across CPU cores on the box, and >>>> can verify using pf_count_multichanel that traffic is being split the way >>>> it should be. >>>> >>>> I compiled Snort on the new box fresh, but copied the configs over. The >>>> old box CPU is currently sitting around 10%, the new box has the cores >>>> pegged at 99-100%. >>>> >>>> I disabled HT on the new box, but the CPU is still maxed. >>>> >>>> This looks like more of a Snort issue, not so much PF_RING, but I asked >>>> over there and they aren't sure what might be the cause. Anyone have any >>>> other ideas of what might be causing this to happen? >>>> >>>> >>>> Scott Finlon, CISSP GCIA >>>> ----------------------------------- >>>> Information Security Engineer >>>> The University of Scranton >>>> email : [email protected] >>>> phone : 570-941-6168 >>>> ----------------------------------- >>>> >>>> >>>> >>>> _______________________________________________ >>>> Ntop-misc mailing list >>>> [email protected] >>>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc >>>> _______________________________________________ >>>> Ntop-misc mailing list >>>> [email protected] >>>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc >>> >>> >>> _______________________________________________ >>> Ntop-misc mailing list >>> [email protected] >>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc >> >> _______________________________________________ >> Ntop-misc mailing list >> [email protected] >> http://listgateway.unipi.it/mailman/listinfo/ntop-misc >> > > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
