hardware for argus with 10GB link

[Peter Van Epp]

On Fri, Apr 23, 2010 at 12:14:02PM -0700, Michael Sanderson wrote:
> We've recently had our campus network connection upgraded to 10Gb and  
> are now looking at our options for tapping that connection and getting  
> argus collecting data again.  We'll be tapping our fibre links with most  
> likely with NetOptics taps, but we're looking for suggestions of  
> appropriate 10Gb NICs for our argus "sensor" box.  We definitely won't  
> be pushing the 10Gb link initially, but I expect that we'll see periods  
> where we approach 2Gb sustained.
>
<snip>

Michael:

	Thinking about this, there  may be an interesting research project
here. Given that BCnet has a 10 Gig capture facility (the Ninja has 16 
terabytes of capture disk) which can capture a signifigant amount of traffic.
Assuning you can get access to the Ninja and taps (BCnet bought 3 10 gig 
capable Netoptic taps as well), it sould be possible to run the Ninja and an
argus box in parallel looking at the same data. If the Ninja captures the 
traffic to a pcap file that can be run through argus (without a speed concern)
to compare to the captured argus data from a sensor. That will tell you whether
the argus sensor can keep up with your traffic (and tell you if configuration 
changes have helped) and as well see how much difference the less accurate time
stamps from a commodity NIC make in real life. It should be possible to 
interest some of the academics from UBC and SFU in such a project which could 
get you man power in the form of grad students.  As well the argus community 
would get some guidelines on what works well at 10 gigs (a win win situation). 
If you need contacts at BCnet send me email and I'll put you in touch (I 
expect verifying that you could borrow the Ninja would be the place to start).
	In addition to the FPGA based capture cards just posted to the list
the Myricom cards (http://www.myri.com/Myri-10G/10gbe_solutions.html) are
popular I understand. The Intel NIC with internal time stamps is Gig not 10 Gig
unfortunatly although it may be worth checking for the same feature in the 
Intel 10 gig NIC cards.

Peter Van Epp