[Oisf-devel] Going to Open Source and plugins

[Victor Julien]

Hi Vasily,

On 09/17/2014 12:27 PM, Sartakov A. Vasily wrote:
> My name is Vasily Sartakov, I am present «ksys labs» company and we are working on development IDS on top of Suricata and own QorIQ-based platform. 
> 
> We have implemented USDPAA support in Suricata, and, compare to AF_PACKET, our platform provides more then 20% performance. We going to share our sources in Open Source, and my question - are you interested in public sources for this specific hardware platform? i.e. we can push our sources in mainline, or we have to support it self in separated project. 

Interesting, I wasn't aware yet of USDPAA. Is it similar to Intel's
DPDK? I think this could be interesting to other users as well, so I'd
be interested in having a look.

> The second question is about plugins support. There is functionality in snort that are need for us. We have to control association of MAC and IP provided by rules. As far I understand, that functionality provided via plugin in Snort. Can you advise right approach for obtaining the same functional in Suricata? What is the best place in sources to «hook», or, maybe, there are plugin engine already under construction? 

We don't currently have a dynamic plugin API. The various keywords are
implemented in a modular way though.

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------