1. CPUs assignation to the detection engine

From 'Adv Config', the administrator will have the possibility to adjust the filtering of the packets captured. This can be done by configuring the number of CPUs, the MTU, local rules or load sharing.

↓

Configuring the number of CPUs per capture engine will optimize the probe's acquisition performance. Sigflow doesn't only have scan engines, so it's normal to have Sigflow processes on CPUs that aren't assigned to it.

↓

Depending on the probe, you can assign a variable number of CPUs to the detection engine. On the exemple you can have the choice between half (1/2), 2/3 CPUs, 3/4, 4/5. With the Custom mode you can assign a number to the CPUs according to the number of CPUs available (example: 1-3.5).

Changing this option requires the immediate restart of GCap, otherwise the behavior may be random.

You can do it with the following CLI command :

set advanced-configuration cpu-config [1/2|2/3|3/4|4/5|Custom(x,y,a-b)] [no-reboot]