hardware for argus with 10GB link

[Guillaume FORTAINE]

  http://www.ntop.org/blog/?p=192

10 Gbit Hardware Packet Filtering Using Commodity Network Adapters

On 04/23/2010 09:14 PM, Michael Sanderson wrote:
> We've recently had our campus network connection upgraded to 10Gb and 
> are now looking at our options for tapping that connection and getting 
> argus collecting data again.  We'll be tapping our fibre links with 
> most likely with NetOptics taps, but we're looking for suggestions of 
> appropriate 10Gb NICs for our argus "sensor" box.  We definitely won't 
> be pushing the 10Gb link initially, but I expect that we'll see 
> periods where we approach 2Gb sustained.
>
> I recall discussion on the list regarding interrupt coalescing on the 
> network cards generating potential issues due to the way that time 
> stamps are assigned to packets.  I know that Endance's DAG cards solve 
> this particular issue by timestamping every packet, but they are 
> expensive and eat a big portion of my hardware budget.
>
> Does anyone recall the specific issues with interrupt coalescing and 
> argus?  There will definitely be potential for out of order TCP 
> connection startup/shutdown.  What is the impact on the flow reporting?
>
> Are there other options to Endance's cards that solve the timestamp 
> problem, either other vendors or system/kernel configuration?
>
> Thanks,
>
>     Michael Sanderson
>     Manager, Computing Facilities
>     Department of Computer Science
>     University of British Columbia
>
>