[Snort-devel] Snort/daq MPI

Y M snort at ...3347...
Wed Feb 24 12:43:38 EST 2016


Hi Carter,


Thanks for getting back. It was more of curiosity while reading Cisco's documentation of the UCS C Series servers. They have a feature they call usNIC (user-space NIC), in which packets completely bypass the kernel from the NIC to the configured user-space application. To an extent, this sounded similar to PF_RING and probably netmap (not sure about load balancing packets), so I thought why not use usNIC with Snort! I am still familiarizing myself with the concept.


Here is the documentation link, look specifically at pages 163-164:


http://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/c/sw/gui/config/guide/2-0/b_Cisco_UCS_C-series_GUI_Configuration_Guide_201.pdf


Sorry don't have more to share.

YM

________________________________
From: Carter Waxman (cwaxman) <cwaxman at ...3461...>
Sent: Wednesday, February 24, 2016 1:40 PM
To: Y M; snort-devel mailinglist
Subject: Re: [Snort-devel] Snort/daq MPI

Hi,

We currently don't have MPI support, however it sounds like it could be an interesting project if you want to take it on. Messaging latency would probably affect your performance, but then again it depends on what exactly its being used to parallelize and how you split your nodes (I'm actually a little curious if you wouldn't mind sharing).

If you're looking for something a little more turn-key, take a look at Snort 3 as we already support multithreading for multiple interfaces.

-Carter

From: Y M <snort at ...3347...<mailto:snort at ...3347...>>
Date: Tuesday, February 23, 2016 at 5:11 PM
To: snort-devel mailinglist <snort-devel at lists.sourceforge.net<mailto:snort-devel at lists.sourceforge.net>>
Subject: Re: [Snort-devel] Snort/daq MPI

*appropriated is actually appreciated. I blame autocorrect!

Sent from Mobile

_____________________________
From: Y M <snort at ...3347...<mailto:snort at ...3347...>>
Sent: Wednesday, February 24, 2016 12:58 AM
Subject: [Snort-devel] Snort/daq MPI
To: snort-devel mailinglist <snort-devel at lists.sourceforge.net<mailto:snort-devel at lists.sourceforge.net>>


Hello,

Does Snort/daq support compiling against the Message Passing Interface? As I understand it so far, the application has to support it or am I completely off?!
I didn't not find the MPI headers in the sources which tells me it's not supported. Resources available on the net are mostly academic so far.

Any pointers are appropriated

Thanks
YM



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20160224/f2502363/attachment.html>


More information about the Snort-devel mailing list