Upon discovering the wonders of PF_RING with DNA, OpenvSwitch L4-hashed port-mirroring, Intel® VT-d / SR-IOV, KVM with VirtIO, and Security Onion, I just knew that these incredibly powerful tools belonged together.
So I'd say this a very early Alpha-stage implementation of what I'm looking to accomplish and document, but I have high hopes for success. The goal is to use the PF_RING DNA drivers (and possibly vPF_RING) to perform transport-layer 5-tuple hashing and load-balancing in hardware, and then hand off the resulting pieces to a team of virtualized network inspection engines for deeper analysis. On the right hardware (modern higher-end Intel NICs), DNA and SR-IOV allow us to perform all this work using Zero-Copy Direct Memory Access, eliminating the need to burn CPU cycles simply to handle interrupts from your NIC. That means more horsepower to inspect all those packets.
UPDATE: I've discovered that OpenvSwitch's L4-hashing mechanism for load-balancing currently only works when LACP is enabled on a bonded link. LACP breaks the technique I'm employing here because it requires that all of the composite members of the port-channel be connected to the same endpoint device. I may have to write some patches for OpenvSwitch to get this working the way I'd like... in the meantime this is still doable with PF_RING.
UPDATE 2: I may have spoken too soon. Perhaps this has already been addressed: http://openvswitch.org/pipermail/dev/2011-May/008934.html
