hardware for argus with 10GB link

[Michael Sanderson]

We've recently had our campus network connection upgraded to 10Gb and 
are now looking at our options for tapping that connection and getting 
argus collecting data again.  We'll be tapping our fibre links with most 
likely with NetOptics taps, but we're looking for suggestions of 
appropriate 10Gb NICs for our argus "sensor" box.  We definitely won't 
be pushing the 10Gb link initially, but I expect that we'll see periods 
where we approach 2Gb sustained.

I recall discussion on the list regarding interrupt coalescing on the 
network cards generating potential issues due to the way that time 
stamps are assigned to packets.  I know that Endance's DAG cards solve 
this particular issue by timestamping every packet, but they are 
expensive and eat a big portion of my hardware budget.

Does anyone recall the specific issues with interrupt coalescing and 
argus?  There will definitely be potential for out of order TCP 
connection startup/shutdown.  What is the impact on the flow reporting?

Are there other options to Endance's cards that solve the timestamp 
problem, either other vendors or system/kernel configuration?

Thanks,

     Michael Sanderson
     Manager, Computing Facilities
     Department of Computer Science
     University of British Columbia