On Tue, Sep 14, 2010 at 12:51 PM, Wilburn, David M. <[email protected]> wrote: > All, > > > > We're looking into high speed packet capture and analysis systems that can > capture at up to 2.5 Gbit/sec. We'd like to perform a lab evaluation, but > somewhat unsure on how to proceed. I don't believe that an artificial > traffic generator would work, because we're very interested in how the > evaluated products process and index application layer data from rebuilt > sessions, and I suspect that rich content data would be missing from > artificially generated traffic. So, I think that probably leaves us with > replaying traffic of existing captures, and speeding up the replay as > necessary to match the peak performance required. I looked through the Wiki > and FAQ on tcpreplay's site, but I'm not sure if the tips there are complete > or current. For instance, it referred to 1 Gbit Intel NICs, but I'll need 10 > Gbit NICs to achieve my performance requirements. > > > > Has anyone successfully used tcpreplay at ~2.5 Gbit/sec or higher rates? If > so, could you please describe your hardware (e.g., 10 gig NICs, storage, > CPU, and quantity of each), and any special OS or tcpreplay tweaks needed to > achieve this? If this is really infeasible using tcpreplay, that'd also be > good to know, along with any pointers towards any alternatives.
What kind of packets/sec are you looking at? In general, tcpreplay tends to be more limited in the number of packets then bandwidth, since bandwidth is just a function of packets/sec * size of packet. FWIW, I know people have done in excess of 400K pps and over 4 Gbps. Ideally you'll want: 1. Enough RAM to cache the pcap in memory or a fast enough disk array to keep up with your bandwidth requirements 2. 10Gbit card with drivers which are optimized for your OS and packet size. I'd stay with a recent Broadcom or Intel personally. 3. Fast enough PCI-e bus to handle the traffic. Expect minimally a 33% overhead for advertised speeds. 4x should be enough in this case. Unfortunately, people generally haven't been able/willing to give me exact hardware/OS configurations, but you should be able to do the math to figure out what should work. -- Aaron Turner http://synfin.net/ Twitter: @synfinatic http://tcpreplay.synfin.net/ - Pcap editing and replay tools for Unix & Windows Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. -- Benjamin Franklin "carpe diem quam minimum credula postero" ------------------------------------------------------------------------------ Start uncovering the many advantages of virtual appliances and start using them to simplify application deployment and accelerate your shift to cloud computing. http://p.sf.net/sfu/novell-sfdev2dev _______________________________________________ Tcpreplay-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/tcpreplay-users Support Information: http://tcpreplay.synfin.net/trac/wiki/Support
