RE: two sniffers on the same eth ifc performance impact?

From: Bryan Burns (bburns@onesecure.com)
Date: 03/27/02 

From: "Bryan Burns" <bburns@onesecure.com>
To: "o00o_j" <o00o_j@yahoo.com>, "Anton Chuvakin" <anton@chuvakin.org>, <focus-ids@securityfocus.com>
Date: Wed, 27 Mar 2002 11:28:52 -0800

If you think about the amount of processing time it takes to respond to the
NIC's interrupt and copy the packet up into user-space, you're much better
off sending the packet to 2 sniffers after it's in user-space then you are
with 2 NICs doing all that processing twice for the same packet. I have no
idea if libpcap is smart enough to handle multiple listeners for the same
packet though.

-Bryan

-----Original Message-----
From: o00o_j [mailto:o00o_j@yahoo.com]
Sent: Wednesday, March 27, 2002 7:08 AM
To: Anton Chuvakin; focus-ids@securityfocus.com
Subject: Re: two sniffers on the same eth ifc performance impact?

This may not be possible, and it's a very straightforward approach, but
what about throwing a second NIC on the host and connecting both NIC's
to a hub along with the uplink, that way you have two interfaces seeing
the same traffic and you can avoid the problem of packet drops at the
NIC... of course you could run into other performance problems, but
they wouldn't be at the NIC-level.

regards,
-j

--- Anton Chuvakin <anton@chuvakin.org> wrote:
> Hi all,
>
> Just a quick question - I was not able to find an answer anywhere,
> and my
> thinking process somehow doesn't lead me to an answer this time ;-)
>
> What is the performance impact of running two sniffers on the same
> eth0
> interface in UNIX/Linux. For example, for whatever weird reason I
> want to
> run two snorts or snort and tcpdump? Will it influence the packet
> drop
> rates? My problem is that I can test it in low traffic environment
> only
> and it will have to be deployed in high-traffic one ;-(
>
> Thanks a lot in advance!
>
> Best,
> --
> Anton A. Chuvakin, Ph.D.
> http://www.chuvakin.org
> http://www.info-secure.org
>
>

__________________________________________________
Do You Yahoo!?
Yahoo! Movies - coverage of the 74th Academy Awards.
http://movies.yahoo.com/

Relevant Pages