Wire-rate Packet Capture on 10gbE

[michael.holstein at csuohio.edu (Michael Holstein)]

> How is this being done? I've looked at looked at PF_RING and TNAPI... is
> there anything better out there?
>   

Those two (thanks to Luca) can get you most of the way there, but to
really hit the target you need dedicated kit like Endace (and a few
others) make. They basically do what was represented in the CCC slides
somebody else posted (FPGA with own logic), but on a PCIe card.

Once you've got the ethernet -> interface problem addressed, you need to
examine bottlenecks in interface->bus and particularly bus->disk.

Regards,

Michael Holstein
Cleveland State Unversity


> --Kyle
>
>