Cool! But I can’t believe you’re Bro instance is doing much inspecting if it’s receiving line-rate packets and only using 1% CPU. As I said before, the majority of the CPU time is usually in pattern matching and protocol decoding (which is basically pattern matching), so I’m assuming that unless the pattern matching is also hardware accelerated, you’re not pattern matching much of the traffic being sent to Bro. Is that the case?
Thanks,
Martin
I believe the 1% utilization is in reference to the slight CPU
interaction with DMA transfers. The rest is left to
<application_of_choice>.
From what I understand of the documentation there are some pattern
matching capabilities in the NT20E that might be leveraged to deliver
specific traffic to the application. I'm still reading if and how
running multiple Bro instances (using cpuset [1]) dedicated to certain
types of traffic will work.
[1]
http://www.freebsd.org/cgi/man.cgi?query=cpuset&sektion=1&apropos=0&manpath=FreeBSD+7.2-RELEASE
HTH,
--Jason
Martin Holste wrote: