# Endace DAG **URL:** \ **Category:** Zeek\ **Created:** [May 15, 2018, 3:39pm UTC](https://community.zeek.org/t/endace-dag/5307 "2018-05-15T15:39:21Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Carl\_Rotenan](https://avatars.discourse-cdn.com/v4/letter/c/d78d45/32.png) [@Carl\_Rotenan](https://community.zeek.org/u/Carl_Rotenan)\ **Post date:** [May 15, 2018, 3:39pm UTC](https://community.zeek.org/t/endace-dag/5307/1 "2018-05-15T15:39:21Z")
Is anyone using the Endace DAG cards? I looking for the performance gains over using PF\_RING and off the shelf Intel cards. Ultimately Iโ€™m looking for the best file extraction performance that can be achieved. Thanks in advance. ---
**Author:** ![Mike\_Patterson](https://avatars.discourse-cdn.com/v4/letter/m/f475e1/32.png) [@Mike\_Patterson](https://community.zeek.org/u/Mike_Patterson)\ **Post date:** [May 15, 2018, 3:59pm UTC](https://community.zeek.org/t/endace-dag/5307/2 "2018-05-15T15:59:16Z")
I don't know how useful my contribution here is, but... Yes, I have a 9.2X2 we purchased in 2010, now in its second server and fourth or fifth Bro install. Obviously having kept it this long, I don't have many complaints. At the same time, I don't find a whole lot of difference between it and the Intel X520s we have deployed with PF\_RING (and one of our newer PF\_RING installations is outperforming the DAG). That said, I've spent more time playing with the X520s, so it's possible the DAG could outperform them with equivalent TLC (and also obviously this is an older card) - but X520s are older nowadays too. I haven't tried the bro-pkg for the DAG yet, although once I've got some free time (hahaha) I would very much like to give it a try. Also YMMV quite a bit depending on the hardware you're marrying to your NICs, your real-world network traffic, specific distribution/kernel version, etc etc etc. And I expect that at least one regular list contributor might suggest you try AF\_PACKET with your Intels. ๐Ÿ™‚ Mike ---
**Author:** ![Carl\_Rotenan](https://avatars.discourse-cdn.com/v4/letter/c/d78d45/32.png) [@Carl\_Rotenan](https://community.zeek.org/u/Carl_Rotenan)\ **Post date:** [May 15, 2018, 5:06pm UTC](https://community.zeek.org/t/endace-dag/5307/3 "2018-05-15T17:06:59Z")
Would you say AF\_PACKET over PF\_RING? Thanks. ---
**Author:** ![Michal\_Purzynski1](https://avatars.discourse-cdn.com/v4/letter/m/a88e57/32.png) [@Michal\_Purzynski1](https://community.zeek.org/u/Michal_Purzynski1)\ **Post date:** [May 15, 2018, 5:21pm UTC](https://community.zeek.org/t/endace-dag/5307/4 "2018-05-15T17:21:05Z")
Yes I would ๐Ÿ™‚ Try afpacket and maybe X710. Youโ€™re going to invest in cards that cost more than your server (DAG) do why not spend 300 usd and make an experiment. [https://github.com/pevma/SEPTun](https://github.com/pevma/SEPTun) [https://github.com/pevma/SEPTun-Mark-II](https://github.com/pevma/SEPTun-Mark-II) This applies to Bro as well, especially the part about hardware and OS tuning. ---
**Author:** ![StephenD](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/stephend/32/615_2.png) [@StephenD](https://community.zeek.org/u/StephenD)\ **Post date:** [May 17, 2018, 5:45am UTC](https://community.zeek.org/t/endace-dag/5307/5 "2018-05-17T05:45:44Z")
As a note, DAG cards are still not $300 (at least new!), but should not cost more than your server. You can figure out who to ask if you are interested in actual pricing I would think. Stephen ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/endace-dag/5307/6 "2022-05-06T15:45:47Z")