[Oisf-devel] Going to Open Source and plugins

[Peter Manev]

On Wed, Sep 17, 2014 at 5:40 PM, Victor Julien <victor at inliniac.net> wrote:
> Hi Vasily,
>
> On 09/17/2014 12:27 PM, Sartakov A. Vasily wrote:
>> My name is Vasily Sartakov, I am present «ksys labs» company and we are working on development IDS on top of Suricata and own QorIQ-based platform.
>>
>> We have implemented USDPAA support in Suricata, and, compare to AF_PACKET, our platform provides more then 20% performance. We going to share our sources in Open Source, and my question - are you interested in public sources for this specific hardware platform? i.e. we can push our sources in mainline, or we have to support it self in separated project.

Very interesting - how did you achieve the 20% difference and what was
the test condition set up like? (if ok to share that info of course)
Are there any dependencies (HW, driver/package versions).

>
> Interesting, I wasn't aware yet of USDPAA. Is it similar to Intel's
> DPDK? I think this could be interesting to other users as well, so I'd
> be interested in having a look.
>
>> The second question is about plugins support. There is functionality in snort that are need for us. We have to control association of MAC and IP provided by rules. As far I understand, that functionality provided via plugin in Snort. Can you advise right approach for obtaining the same functional in Suricata? What is the best place in sources to «hook», or, maybe, there are plugin engine already under construction?
>
> We don't currently have a dynamic plugin API. The various keywords are
> implemented in a modular way though.
>



-- 
Regards,
Peter Manev