[Snort-devel] Snort/daq MPI

Y M snort at ...3347...
Wed Feb 24 12:43:38 EST 2016

Hi Carter,

Thanks for getting back. It was more of curiosity while reading Cisco's documentation of the UCS C Series servers. They have a feature they call usNIC (user-space NIC), in which packets completely bypass the kernel from the NIC to the configured user-space application. To an extent, this sounded similar to PF_RING and probably netmap (not sure about load balancing packets), so I thought why not use usNIC with Snort! I am still familiarizing myself with the concept.

Here is the documentation link, look specifically at pages 163-164:


Sorry don't have more to share.


From: Carter Waxman (cwaxman) <cwaxman at ...3461...>
Sent: Wednesday, February 24, 2016 1:40 PM
To: Y M; snort-devel mailinglist
Subject: Re: [Snort-devel] Snort/daq MPI


We currently don't have MPI support, however it sounds like it could be an interesting project if you want to take it on. Messaging latency would probably affect your performance, but then again it depends on what exactly its being used to parallelize and how you split your nodes (I'm actually a little curious if you wouldn't mind sharing).

If you're looking for something a little more turn-key, take a look at Snort 3 as we already support multithreading for multiple interfaces.


From: Y M <snort at ...3347...<mailto:snort at ...3347...>>
Date: Tuesday, February 23, 2016 at 5:11 PM
To: snort-devel mailinglist <snort-devel at lists.sourceforge.net<mailto:snort-devel at lists.sourceforge.net>>
Subject: Re: [Snort-devel] Snort/daq MPI

*appropriated is actually appreciated. I blame autocorrect!

Sent from Mobile

From: Y M <snort at ...3347...<mailto:snort at ...3347...>>
Sent: Wednesday, February 24, 2016 12:58 AM
Subject: [Snort-devel] Snort/daq MPI
To: snort-devel mailinglist <snort-devel at lists.sourceforge.net<mailto:snort-devel at lists.sourceforge.net>>


Does Snort/daq support compiling against the Message Passing Interface? As I understand it so far, the application has to support it or am I completely off?!
I didn't not find the MPI headers in the sources which tells me it's not supported. Resources available on the net are mostly academic so far.

Any pointers are appropriated


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20160224/f2502363/attachment.html>

More information about the Snort-devel mailing list