[Oisf-devel] Going to Open Source and plugins

[Sartakov A. Vasily]

> On 09/17/2014 12:27 PM, Sartakov A. Vasily wrote:
>> My name is Vasily Sartakov, I am present «ksys labs» company and we are working on development IDS on top of Suricata and own QorIQ-based platform. 
>> 
>> We have implemented USDPAA support in Suricata, and, compare to AF_PACKET, our platform provides more then 20% performance. We going to share our sources in Open Source, and my question - are you interested in public sources for this specific hardware platform? i.e. we can push our sources in mainline, or we have to support it self in separated project. 
> 
> Interesting, I wasn't aware yet of USDPAA. Is it similar to Intel's
> DPDK? I think this could be interesting to other users as well, so I'd
> be interested in having a look.

Oh, sorry, I forgot to provide the link: http://www.freescale.com/webapp/sps/site/overview.jsp?code=QORIQ_DPAA 
It is a special hardware engine inside QorIQ SoC. 

>> The second question is about plugins support. There is functionality in snort that are need for us. We have to control association of MAC and IP provided by rules. As far I understand, that functionality provided via plugin in Snort. Can you advise right approach for obtaining the same functional in Suricata? What is the best place in sources to «hook», or, maybe, there are plugin engine already under construction? 
> 
> We don't currently have a dynamic plugin API. The various keywords are
> implemented in a modular way though.


So, as I understand, we have to implement this functionality from scratch. Can you give advice? We have to register new keyword, right, and add MAC address processing somewhere?

-- 
Sartakov A. Vasily
sartakov at ksyslabs.org



-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 842 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-devel/attachments/20140918/ddd8ce7d/attachment.sig>