Description
This article briefly describes the steps that are required to setup interface bonding on a sensor. Interface bonding can be useful to multiplex together packets delivered to multiple sniffing interfaces. The typical use case for this is the operation with hardware tap devices who deliver inbound and outbound packets on two separate network interfaces.
Known issues
It should be noted that at the time of writing the use of interface bonding has some minor side-effects on the sensor operation. More specifically, the use of interface bonding causes certain appliance metrics (network traffic processed and packet processed) to stop operating correctly. This does not affect however the overall operation of the sensor.
While interface bonding can be applied on both 1Gbps and 10Gbps interfaces, when using bonding we loose support for NIC hardware queues (RSS). The performance of a 10Gbps sensor with interface bonding is therefore lower than its non-bonding counterpart.
Implementation
The interface bonding configuration mostly relies on the underlying Ubuntu OS support (https://help.ubuntu.com/community/UbuntuBonding).
Note: The interface names below are an example, please update eth4 and eth5 to the relevant interfaces names specific to your deployment.
1. Before proceeding to the configuration, deactivate the interfaces you intend to bond together. In this example, let's assume that the relevant interfaces are eth4 and eth5:
ifdown eth4
ifdown eth5
2. Edit the ubuntu network configuration file (/etc/network/interfaces) in order to define the bonding interface. Notice that entries for the sniffing interfaces eth4 and eth5 are likely to be already present, but they need to be updated with a reference to the bond-master. Example:
INFO - Applying configuration finished successfully.