Wire-rate Packet Capture on 10gbE

Michael Holstein michael.holstein at csuohio.edu
Fri Apr 29 14:43:39 UTC 2011

> How is this being done? I've looked at looked at PF_RING and TNAPI... is
> there anything better out there?

Those two (thanks to Luca) can get you most of the way there, but to
really hit the target you need dedicated kit like Endace (and a few
others) make. They basically do what was represented in the CCC slides
somebody else posted (FPGA with own logic), but on a PCIe card.

Once you've got the ethernet -> interface problem addressed, you need to
examine bottlenecks in interface->bus and particularly bus->disk.


Michael Holstein
Cleveland State Unversity

> --Kyle

More information about the NANOG mailing list