There is quite a lot of documentation provided with the Napatech cards if you are a customer, but the default configs provided aren’t what you want to use to hit the ground running for IDS setups. To configure the card to split the traffic up into 8 streams by hashing the headers, create a /opt/napatech/config/custom.cfg file that contains the following. We of course are assuming you have installed the necessary hardware/software and compiled basic tools like tcpdump against the Napatech provided libpcap:
#=NTPL=# DeleteFilter=All HashMode=Hash5TupleSorted SetupPacketFeedEngine[TimeStampFormat=PCAP;DescriptorType=PCAP;MaxLatency=1000;SegmentSize=4096;Numfeeds=8] PacketFeedCreate[NumSegments=16;Feed=(0..7)] Capture[Priority=0;Feed=(0..7)] = ALL
Now start the driver up:
[user@host]# /opt/napatech/bin/load_driver.sh ntxc0=/opt/napatech/config/custom.cfg
You should now be able to see that the streams are accessible by running the tcpdump with the -D flag:
# tcpdump -D 1.eth0 2.ntxc0:0 (NT adapter 0 feed 0) 3.ntxc0:1 (NT adapter 0 feed 1) 4.ntxc0:2 (NT adapter 0 feed 2) 5.ntxc0:3 (NT adapter 0 feed 3) 6.ntxc0:4 (NT adapter 0 feed 4) 7.ntxc0:5 (NT adapter 0 feed 5) 8.ntxc0:6 (NT adapter 0 feed 6) 9.ntxc0:7 (NT adapter 0 feed 7) 10.any (Pseudo-device that captures on all interfaces) 11.lo
Great posts about the Napatech cards! Would love to read more about your experience with these, the kind of performance you get, on what kind of hardware…
If you also use them to capture full content data what kind of disk setup to you use to be able to keep up and provide enough IO while monitoring high bandwith links.