[Snort-devel] [PATCH] DPDK DAQ Module

Michael Altizer xiche at ...1778...
Fri Jun 17 03:41:48 EDT 2016

On 06/16/2016 02:41 PM, Maxim Uvarov wrote:
> On 06/16/16 17:37, Tiwei Bie wrote:
>> On Thu, Jun 16, 2016 at 08:42:33PM +0800, Tiwei Bie wrote:
>>> On Thu, Jun 16, 2016 at 02:22:01PM +0300, Maxim Uvarov wrote:
>>>> That is single thread dpdk-daq module, right?
>>> The thread created by rte_eal_init() won't be used. All the daq
>>> methods (e.g. dpdk_daq_acquire) will run on the snort's thread
>>> context.
>> More details:
>> The thread which calls rte_eal_init() will become DPDK's master
>> thread. So, when you only specify one lcore with eal's -c option,
>> such as: -c 40, no DPDK's slave threads will be created. And the
>> affinity of the snort thread which becomes DPDK's master thread
>> will be set to CPU6 (the 7th CPU).
>> When you specify more than one lcores with eal's -c option, such
>> as: -c ff, seven slave threads will be created by rte_eal_init().
>> But they won't be used.
>> And the daq methods (e.g. dpdk_daq_acquire) will be called in the
>> snort thread context.
>> Best regards,
>> Tiwei Bie
> I'm asked that question because I had in plan update daq module for
> OpenDataPlane:
> https://github.com/Xiche/daq_odp
> And for some previous version there were problems in scaling snort
> across number of cpus.
> Which looks like solved in 3.X and will be never fixed in 2.9.x.
> But now I think I can follow your patch to integrate ODP to mainline snort.
> Best regards,
> Maxim.

FYI - the ODP DAQ module above has been updated to work again with ODP 
v1.10.1.  Like the DPDK DAQ module, it operates in a single-threaded 
mode, driven by the DAQ acquire API being called by Snort.  As you 
surmised, there is no intention to make it work in a different fashion 
for 2.x, but the goal is to be able to have it more cooperatively 
multi-instantiate within the multi-threaded architecture of Snort 3.x.


More information about the Snort-devel mailing list