[Coral-dev] Multithreaded crl_flow

[Stephen Donnelly]

Depending on the DAG model you may be able to use flow based load balancing in hardware in order to distribute the IP flows over up to 32-receive streams, allowing you to run up to 32 crl_flow instances at once (assuming you have enough cores!).

You would still have to stitch the results of the instances together somehow.

Regards,
Stephen.

-----Original Message-----
From: coral-dev-bounces at caida.org [mailto:coral-dev-bounces at caida.org] On Behalf Of Ken Keys
Sent: Tuesday, 3 April 2012 7:26 a.m.
To: James Grace
Cc: Julio Ibarra; coral-dev at caida.org
Subject: Re: [Coral-dev] Multithreaded crl_flow

On Mon, Apr 02, 2012 at 09:20:02AM -0400, James Grace wrote:
> Hey List,
> 
> I have a 10G DAG card and I'm trying to get Coral Reef up and running, 
> but I'm running into a pretty substantial problem.  Whenever I'm 
> running crl_flow, It's only running in one thread, thus causing the 
> process to drop a lot of packets. Is there a multithreaded flag for 
> crl_flow, or one of the collecting applications?
> 
> Cheers,
> James Grace
> Network Engineer
> AMPATH / CIARA
> Florida International University

Sorry, there is no multithreaded option or alternative to crl_flow.

However, you might consider using crl_anf, which uses a sophisticated sampling algorithm to produce an estimated version of crl_flow results, with reduced memory and CPU requirements compared to crl_flow.

--
Ken Keys
kkeys at caida.org

_______________________________________________
Coral-dev mailing list
Coral-dev at caida.org
https://rommie.caida.org/mailman/listinfo/coral-dev