[Snort-users] Snort-users Digest, Vol 75, Issue 79

Stefano Debenedetti ste at ...15794...
Fri Aug 31 07:00:49 EDT 2012


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Il 30/08/2012 18:02, snort-users-request at lists.sourceforge.net ha >
Message: 3
> Date: Thu, 30 Aug 2012 16:43:52 +0100 From: Peter Bates
> <peter.bates at ...15381...> Subject: Re: [Snort-users] Large receive
> offload, good or bad? To: <snort-users at lists.sourceforge.net> 
> Message-ID: <503F8A38.503 at ...15381...> Content-Type: text/plain;
> charset="ISO-8859-1"
> 
> 
> Hello all
> 
> Interesting topic, as I've been pondering the same thing this
> week.
> 
> On 30/08/2012 15:59, Joel Esler wrote:
>> If I was deploying an I[DP]S I would investigate using a
>> operating system and network card that supports zero copy bpf
>> sockets. This will save you much more CPU time than using LRO and
>> have much more predictable results.
> 
> Can the VRT member who is not on the list expand a bit more on
> this?
> 
> Are we talking *BSD, Linux AF_PACKET with fanout, PF_RING, ?

interesting topic indeed, netmap [1], PFQ [2], anyone?

ciao
ste

[1] http://info.iet.unipi.it/~luigi/netmap/
[2] http://netserv.iet.unipi.it/software/pfq/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAlBAmWEACgkQie5Je5IlqGbhWwCeIhBwQY6zj45W5KMU9eEu9B6/
lfMAn2l7lJGrOdPH6yMfHAOpP9LXA8Nr
=t0nx
-----END PGP SIGNATURE-----




More information about the Snort-users mailing list