Thanks! I haven't looked at the exact distribution of packet size in our potential data sets, but I figure Simple IMIX's average packet size of 340.3 bytes plus 18 bytes of Ethernet header might be a good rule of thumb.[1] If my math is right, that'd be somewhere around 117 Kpps for 2.5 Gbps, right?
We'd probably want to replay several TB worth of captured data, so loading it into RAM is probably not a good option. Given that we want to test indexing of application layer content, I'm reluctant to loop a smaller data set repeatedly. That's probably going to mean reading from disk, probably a fibrechannel SAN that we have available. If anyone has more exact hardware specs or software tuning recommendations, I'd really appreciate it. The target OS would probably be some flavor of Linux 2.6.x. Thanks, Dave Wilburn [1] http://tecun.cimex.com.cu/tecun/software/Soporte%20Tecnico%20de%20Redes/Cisco/Routers/OTROS/1MxdPktSzThroughput.pdf ________________________________________ From: Aaron Turner [synfina...@gmail.com] Sent: Tuesday, September 14, 2010 5:18 PM To: Main forum for tcpreplay Subject: Re: [Tcpreplay-users] tcpreplay at 2.5 Gbit/sec? On Tue, Sep 14, 2010 at 12:51 PM, Wilburn, David M. <dwilb...@mitre.org> wrote: > All, > > > > We're looking into high speed packet capture and analysis systems that can > capture at up to 2.5 Gbit/sec. We'd like to perform a lab evaluation, but > somewhat unsure on how to proceed. I don't believe that an artificial > traffic generator would work, because we're very interested in how the > evaluated products process and index application layer data from rebuilt > sessions, and I suspect that rich content data would be missing from > artificially generated traffic. So, I think that probably leaves us with > replaying traffic of existing captures, and speeding up the replay as > necessary to match the peak performance required. I looked through the Wiki > and FAQ on tcpreplay's site, but I'm not sure if the tips there are complete > or current. For instance, it referred to 1 Gbit Intel NICs, but I'll need 10 > Gbit NICs to achieve my performance requirements. > > > > Has anyone successfully used tcpreplay at ~2.5 Gbit/sec or higher rates? If > so, could you please describe your hardware (e.g., 10 gig NICs, storage, > CPU, and quantity of each), and any special OS or tcpreplay tweaks needed to > achieve this? If this is really infeasible using tcpreplay, that'd also be > good to know, along with any pointers towards any alternatives. What kind of packets/sec are you looking at? In general, tcpreplay tends to be more limited in the number of packets then bandwidth, since bandwidth is just a function of packets/sec * size of packet. FWIW, I know people have done in excess of 400K pps and over 4 Gbps. Ideally you'll want: 1. Enough RAM to cache the pcap in memory or a fast enough disk array to keep up with your bandwidth requirements 2. 10Gbit card with drivers which are optimized for your OS and packet size. I'd stay with a recent Broadcom or Intel personally. 3. Fast enough PCI-e bus to handle the traffic. Expect minimally a 33% overhead for advertised speeds. 4x should be enough in this case. Unfortunately, people generally haven't been able/willing to give me exact hardware/OS configurations, but you should be able to do the math to figure out what should work. -- Aaron Turner http://synfin.net/ Twitter: @synfinatic http://tcpreplay.synfin.net/ - Pcap editing and replay tools for Unix & Windows Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. -- Benjamin Franklin "carpe diem quam minimum credula postero" ------------------------------------------------------------------------------ Start uncovering the many advantages of virtual appliances and start using them to simplify application deployment and accelerate your shift to cloud computing. http://p.sf.net/sfu/novell-sfdev2dev _______________________________________________ Tcpreplay-users mailing list Tcpreplay-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/tcpreplay-users Support Information: http://tcpreplay.synfin.net/trac/wiki/Support ------------------------------------------------------------------------------ Start uncovering the many advantages of virtual appliances and start using them to simplify application deployment and accelerate your shift to cloud computing. http://p.sf.net/sfu/novell-sfdev2dev _______________________________________________ Tcpreplay-users mailing list Tcpreplay-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/tcpreplay-users Support Information: http://tcpreplay.synfin.net/trac/wiki/Support
