3 ms·
Should be fairly fast still in low traffic volume mode. The challenge is doing at scale. With low volume traffic, the code spends most of it's time blocked wai
by acveilleux 12y ago
Should be fairly fast still in low traffic volume mode. The challenge is doing at scale.
With low volume traffic, the code spends most of it's time blocked waiting for the next packet so the response is very quick.
With high volumes, especially high volume of small packets, the code can get seriously backlogged and even miss packets altogether if the raw interface isn't serviced fast enough.
H/W acceleration is needed to do this at backbone volumes.
Once upon a time (over 10 years ago) I was working in the field of high-volume NIDS and keeping up with (then blazing fast) GiGE LAN volumes was very challenging with the CPU alone back then. And that was with tuned rule sets / minimal pre-processors / no other I/O in the hot path.