Kaspersky Anti Targeted Attack (KATA) Platform

Optimization of network interface settings for the Sensor component

April 2, 2024

ID 266301

Follow these instructions if the application encounters network packet loss or performance issues when processing network traffic.

To reduce network packet loss and incomplete extraction of files from traffic:

  1. Specify the maximum number of RSS queues:
    • If the data transfer rate on your network is less than 1 Gbps, set the number to 1.
    • If the data transfer rate on your network is greater than 1 Gbps, set the number to 16.

    If your network interface does not allow setting the maximum number of RSS queues to 16, set it to the maximum supported number.

  2. Configure symmetric RSS hashing for the network interface. For details on configuring RSS hashing, refer to the vendor documentation of your network adapter.
  3. Create an interrupts.sh file with the following content.
  4. Run the following command:

    sudo bash interrupts.sh <dev> <min_cpu> <max_cpu> <step>, where

    • <dev> is the network interface whose interrupts you want to distribute among cores.
    • <min_cpu> is the first core in the range for network adapter interrupt distribution.
    • <max_cpu> is the last core in the range for network adapter interrupt distribution.
    • <step>is the increment for picking the next core to assign to interrupts.

      Example:

      sudo bash interrupts.sh ens192 2 11 1

  5. If you are using NVIDIA Mellanox network adapters (mlx4), configure the number of RSS queues and RSS hashing by running the following commands:

    ethtool -L $dev rx 16

    ethtool -X $dev equal 16

    ethtool -X $dev hfunc xor

  6. If you are using Intel network adapters (i40e), configure the number of RSS queues and RSS hashing:

    rmmod i40e && modprobe i40e

    ifconfig $dev down

    ethtool -L $dev combined 16

    ethtool -K $dev rxhash on

    ethtool -K $dev ntuple on

    ifconfig $dev up

    ethtool -X $dev hkey 6D:5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:

    5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:5A:6D:5A equal 16

    ethtool -A $dev rx off

    ethtool -C $dev adaptive-rx off adaptive-tx off rx-usecs 125

    ethtool -G $dev rx 1024

    ethtool -N $dev rx-flow-hash tcp4 sdfn

    ethtool -N $dev rx-flow-hash tcp6 sdfn

    ethtool -N $dev rx-flow-hash udp4 sdfn

    ethtool -N $dev rx-flow-hash udp6 sdfn

The network interfaces are configured.

After restarting the application, you must reconfigure the network interfaces following the instructions.

Did you find this article helpful?
What can we do better?
Thank you for your feedback! You're helping us improve.
Thank you for your feedback! You're helping us improve.