[prev in list] [next in list] [prev in thread] [next in thread] 

List:       snort-users
Subject:    Re: [Snort-users] Building DAQ for freebsd - afpacket
From:       Shirkdog <shirkdog () gmail ! com>
Date:       2015-01-22 20:56:19
Message-ID: CAKFsjL4anbiQa1xuCpkwZ+tFSFnBWXf0MksVFw4WAdtcoOD2dA () mail ! gmail ! com
[Download RAW message or body]

I have not dug into it, but netmap i/o should be a performance gain
specific to FreeBSD.

---
Michael Shirk


On Thu, Jan 22, 2015 at 3:34 PM, Al Lewis (allewi) <allewi@cisco.com> wrote:
> I am not sure you can with FreeBSD. See below which is taken from the daq
> readme.
>
>
>
> NOTE: Linux kernel version 2.6.31 or higher is required for the AFPacket DAQ
>
> module due to its dependency on both TPACKET v2 and PACKET_TX_RING support.
>
>
>
>
>
> Albert Lewis
>
> QA Software Engineer
>
> SOURCEfire, Inc. now part of Cisco
>
> 9780 Patuxent Woods Drive
> Columbia, MD 21046
>
> Phone: (office) 443.430.7112
>
> Email: allewi@cisco.com
>
>
>
> From: Tony Robinson [mailto:deusexmachina667@gmail.com]
> Sent: Thursday, January 22, 2015 2:43 PM
> To: snort-users@lists.sourceforge.net
> Subject: [Snort-users] Building DAQ for freebsd - afpacket
>
>
>
> Hello,
>
> In my continued adventures in freebsd... I'm having build the afpacket
> module for freebsd. whenever I attempt to ./configure daq-2.0.4 I get the
> following output at the end of the configure script:
>
> Build AFPacket DAQ module.. : no
> Build Dump DAQ module...... : yes
> Build IPFW DAQ module...... : yes
> Build IPQ DAQ module....... : no
> Build NFQ DAQ module....... : no
> Build PCAP DAQ module...... : yes
> Build netmap DAQ module...... : yes
>
> The part i'm interested in is AFPacket, and why its set to no. I asked a
> little bit about this on the snort IRC channel, and the recommendation I was
> given to try was to run ./configure --disable-netmap-module which changes to
> this:
>
> Build AFPacket DAQ module.. : no
> Build Dump DAQ module...... : yes
> Build IPFW DAQ module...... : yes
> Build IPQ DAQ module....... : no
> Build NFQ DAQ module....... : no
> Build PCAP DAQ module...... : yes
> Build netmap DAQ module...... : no
>
> with seemingly no affect to afpacket DAQ at all. Have any of you had success
> building afpacket DAQ on freebsd?
>
> Thank you in advance for any assistance you can offer.
>
> --
>
> when does reality end? when does fantasy begin?
>
>
> ------------------------------------------------------------------------------
> New Year. New Location. New Benefits. New Data Center in Ashburn, VA.
> GigeNET is offering a free month of service with a new server in Ashburn.
> Choose from 2 high performing configs, both with 100TB of bandwidth.
> Higher redundancy.Lower latency.Increased capacity.Completely compliant.
> http://p.sf.net/sfu/gigenet
> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest Snort
> news!

------------------------------------------------------------------------------
New Year. New Location. New Benefits. New Data Center in Ashburn, VA.
GigeNET is offering a free month of service with a new server in Ashburn.
Choose from 2 high performing configs, both with 100TB of bandwidth.
Higher redundancy.Lower latency.Increased capacity.Completely compliant.
http://p.sf.net/sfu/gigenet
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!
[prev in list] [next in list] [prev in thread] [next in thread]