Remember that your SATA bus doesnt push more than 6gbit/s no matter what.So many of the systems sold cannot push more than that.SAS pushes 12gbit/s and Nvme is limitless. (more depending on NIC's and CPU).
Quote from: Supermule on December 31, 2022, 10:59:11 amRemember that your SATA bus doesnt push more than 6gbit/s no matter what.So many of the systems sold cannot push more than that.SAS pushes 12gbit/s and Nvme is limitless. (more depending on NIC's and CPU).This thread is getting spammed by people who completely miss the topic.Can the moderators close this topic?It may take some cpu generations until 10gbps IPS are in reach. Until then this discussion goes nowhere.
What does disk bandwidth - though factually correct - have to do with IPS performance?
But with 10 Gbps network to scan as the OP asked, and 9X% of all traffic being irrelevant - do you really think SATA could ever become a bottleneck?You don't log unsuspicious/permitted connections, do you?
Hi,Suricata on FreeBSD uses Netmap to achieve IPS functionality. Judging by your logs, you are indeed using netmap to bypass the host stack and enable Suricata to inspect packets straight off the wire. Note the way ports are opened:ix0/R (Receive thread) --> ix0^ (Host stack)ix0^ (Host stack) --> ix0/T (Transmit thread)This simply means that on initialization, netmap opens two "ports" - one on which to capture packets, at which point Suricata will be able to do it's thing, and another port that represents the host stack (using the '^' symbol), which is used by Suricata to forward inspected packets back to the host stack. The same principle applies on the transmit side (but reversed) - totalling a thread usage of 4 in a default setup.The way Netmap is currently implemented does not allow for more than one thread to connect to the host stack on both the receive and transmit side. Manually increasing the amount of threads will not ensure a gain in throughput, and any measured increase in throughput will be wrong, since packets on different threads might not even reach Suricata and thus could potentially even skip by Suricata, due to a lack of synchronization.In conclusion, Suricata on FreeBSD currently only supports one thread in IPS mode. However, Netmap has recently committed support for multiple threads towards the host stack in FreeBSD, and Suricata is in the process of integrating this into their software - so keep an eye on that.Cheers,Stephan