Search: Home Bugtraq Vulnerabilities Mailing Lists Jobs Tools Beta Programs
Focus on IDS
RE: port bonding and taps Oct 02 2003 03:00PM
PPowenski oag com (2 replies)
Re: port bonding and taps Oct 02 2003 06:34PM
Bennett Todd (bet rahul net) (1 replies)
Re: port bonding and taps Oct 03 2003 06:04PM
Sam f. Stover (sstover iwc sytexinc com) (1 replies)
Re: port bonding and taps Oct 03 2003 06:46PM
Bennett Todd (bet rahul net) (1 replies)
2003-10-03T14:04:12 Sam f. Stover:
> I'd like to know where the overhead imposed by the bonding causes
> packet drops.

Please keep an open mind, and make that "where and whether".

In my experience bonding's overhead was so negligible that I doubt
it would show up as a critical factor in any configuration.

Happily, tcpdump -s0 will capture a nice test file from wherever
you're planning on snorting, and tcpreplay makes it easy to blast it
back at your snorter. Set up N boxes, where N == twice the number of
taps you're going to support, and have 'em blast into the bonded
NICs over crossover cables, with tcpreplay. You can control the
playback speed, you know how many packets went out, so you can
subtract from how many were snorted to measure exactly how many were
dropped.

-Bennett

[ reply ]
Re: port bonding and taps Oct 03 2003 07:19PM
Sam f. Stover (sstover iwc sytexinc com)
Re: port bonding and taps Oct 02 2003 03:34PM
Sam f. Stover (sstover iwc sytexinc com)







 

Privacy Statement
Copyright 2009, SecurityFocus