[Snort-devel] HyperScan

Jaime Nebrera jnebrera at ...3500...
Wed Oct 21 04:06:02 EDT 2015

   Hi all,

   Intel announced just yesterday that it was open sourcing HyperScan 
pattern matching engine: https://01.org/hyperscan

   Funny enough, an Intel employee made a presentation about HyperScan 
in last DPDK Summit event in Dublin 
(http://www.slideshare.net/harryvanhaaren/hyperscan-mohammad-abdul-awal), and 
at the time seemed quite weird as they stated it was a "proprietary 
product" and that "was not available as part of DPDK". Now it makes full 
sense :D

   As a brief introduction, HyperScan is the commercial name of a 
technology developed by Sensory Networks that Intel aquired some time 
ago. Sensory used to work with FPGA based cards when it started, and 
later on opted for a "software only" mode when they saw the numbers were 
"on pair". This is the technology that has ended up as HyperScan. I 
guess some other members can contribute with more info here, I'm pretty 
sure it is used in McAfee products, but don't know about others.

   At the time, they had a ported Snort version able to use this 
software. Seems this piece has not been open sourced. I don't know if 
they plan to do so or not.

   Either way, it would be great to hear your opinion on this technology.

   Our team plans to start working on porting Snort to use this engine 
ASAP, and would kindly welcome anybody interested in collaborating with 
the effort.

   We will create a branch in our Snort Github project


More information about the Snort-devel mailing list