[netsa-tools-discuss] rwflowpack

[John Green]

Hi,
Is anyone using large numbers of internal/external-ipblocks with Silk?

I've found CPU usage increases considerably when using lots of CIDR
blocks with both twoway and generic.   With over 2000 CIDR blocks
rwflowpack maxes out all my 4 CPUs (400%).    With 180 CIDR blocks CPU
is down to around 150%.   Reducing to just one CIDR block results in CPU
of 30%, which is similar to an existing flow-capture process
(flow-tools).

Has anyone developed an alternate packlogic which does ip lookups more
efficiently, perhaps using a Trie?   Not many of my exporters are on the
network edge, so using interfaces isn't really feasible.

Thanks
John


Janet(UK) is a trading name of Jisc Collections and Janet Limited, a 
not-for-profit company which is registered in England under No. 2881024 
and whose Registered Office is at Lumen House, Library Avenue,
Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238