I am looking at increasing the performance of Bro by making use of PF_RING and TNAPI, at the kernel and driver level in Linux. These existing tools from http://www.ntop.org/news.php allow multi-threaded applications to drastically increase performance by making use of functionality that exists in several network cards today.
While PF_RING, TNAPI and other network-card functionality allow for phenomenal speed-up, they have to be tuned right or else they can lead to a negative effect on performance. So I'm trying to determine how to tune them to meet Bro's needs.
As Multi-threaded Bro is not ready yet, I am trying to think of a SIMPLE application that can best characterize the Bro workload. The design criteria that I have for this application so far is-
1. Send every packet belonging to a particular connection to the same core.
2. Introduce a small wait on every packet to simulate Bro's processing of that packet? What will be a good value?
I'd be very interested to have everyone's opinion on this. I really am looking for a very simple algorithm that will be a right approximation.