> I suggested that approach based on SolarCapture which was available by > SolarFlare for their cards. They have 1 solar_capture process where you > define multiple capture cores and one writeout core. Not sure if anyone used > SolarFlare SFN5122/7122 cards. They used to offer free solar_capture tool for > near loss-less capture. The issue of bottleneck on write to HD should be > reduced by using SSD. We use SSD and lots of RAM.
Some can do it, some can't ;-) I would have to buy 50TB of SSD that would fail frequently. I keep it now on a bunch of SATA and it works and several disks die per year (2-3). > > The ultimate scenario for lossless capture I was suggested by SolarFlare is > something like : 6 Rx queues for NIC and 6 capture cores and 1 writeout core > for solar_capture, all on same physical CPU. Not sure how they did it and why > did they suggest this approach, but their tool doesn't start multiple > solar_capture processes, but shows one process using 300% of CPU if you use 3 > capture cores for example. I can only guess on "how" but I might know "why". 1. 6+1 process? because we have 8 cores CPUs 2. why a single cpu? to keep the NUMA affinity and avoid the QPI cross-talk 3. why a single cpu again? Because L3 cache is shared between the cores on modern CPU and is inclusive, so all data from L1 and L2 are in L3 (guaranteed on Intel). So instead of going through RAM (which is slow) one thread can capture packets and the other one that writes them to disk takes data from either the other core L1/L2 (if lucky) or L3 (all the time). This is fast. Also they seem to use threads not processes. Does not matter a lot on Linux (performance wise) - might be easier for sharing data. Now I would add DCA to the mix, I wonder if they use it. Also they might use some kind of direct NIC access instead of pushing packets through the kernel like we do. -- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
