freebsd stable - Jul 2006 - if_bridge.c question

I am running 6.1 release on some systems. I have a question about the bridging
changes in if_bridge.c which were made in the stable branch. I am having a
problem bonding two heavily loaded network interfaces for IDS purposes. There is
greatly increased  packets droppage when using  'ifconfig bridge0
monitor' to merge the two sniff interfaces under 6.1 release. (I am trying
to get around using two concurrent Snort processeses)

Is it expected that the new bridge monitor function introduced in the stable
branch will have much less packet droppage in identical situations when bonding
busy interfaces? If so is there a way to get this without upgrading whole system
to 6.1 stable? Will binary upgrade using 6.1 stable ISO provide this
functionality also?

Also I had tried netgraph (and one2many) to bond the interfaces and it worked
fine but at traffic peaks during day it would eventually stop seeing any packets
at all on the virtual interface. Thanks

On Tue, Jul 04, 2006 at 11:04:16AM -0400, Raymond Owens
wrote:
> I am running 6.1 release on some systems. I have a question about the
> bridging changes in if_bridge.c which were made in the stable branch.
> I am having a problem bonding two heavily loaded network interfaces
> for IDS purposes. There is  greatly increased  packets droppage when
> using  'ifconfig bridge0 monitor' to merge the two sniff interfaces
> under 6.1 release. (I am trying to get around using two concurrent
> Snort processeses)
> 
> Is it expected that the new bridge monitor function introduced in the
> stable branch will have much less packet droppage in identical
> situations when bonding busy interfaces? If so is there a way to get
> this without upgrading whole system to 6.1 stable? Will binary upgrade
> using 6.1 stable ISO provide this functionality also?
You can just grab src/sys/net/if_bridge.c from the stable branch and
build it on 6.1. You can either rebuild the kernel or if you are using
modules then make && make install in src/sys/modules/if_bridge.

Let me know if you get stuck.


cheers,
Andrew