[140030] in North American Network Operators' Group
Re: Wire-rate Packet Capture on 10gbE
daemon@ATHENA.MIT.EDU (Michael Holstein)
Fri Apr 29 10:43:35 2011
Date: Fri, 29 Apr 2011 10:43:39 -0400
From: Michael Holstein <michael.holstein@csuohio.edu>
To: Kyle Creyts <kyle.creyts@gmail.com>
In-Reply-To: <BANLkTimr+sFRHXOpDD5pSB4ZP=W6+f-bnA@mail.gmail.com>
Cc: nanog@nanog.org
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
> How is this being done? I've looked at looked at PF_RING and TNAPI... is
> there anything better out there?
>
Those two (thanks to Luca) can get you most of the way there, but to
really hit the target you need dedicated kit like Endace (and a few
others) make. They basically do what was represented in the CCC slides
somebody else posted (FPGA with own logic), but on a PCIe card.
Once you've got the ethernet -> interface problem addressed, you need to
examine bottlenecks in interface->bus and particularly bus->disk.
Regards,
Michael Holstein
Cleveland State Unversity
> --Kyle
>
>
