Can Suricata version 7.0.0-rc2 receive packets from memif via DPDK

Developers
11

Hi, Lukas!

I’m sorry to be late with the reply.

Is that a typo in your RX results of 7.0.0rc2 in IPS mode where you noted rx only gives you 700Kbps >(possibly Mbps)?

No, exactly 700Kbps. And it is related exactly to the fact that I am setting 0 for the socket id.

There is a slight difference- your solution sets 0 to the socket id, mine sets SOCKET_ID_ANY which >made more sense to me (as it better represents the state of the nic) but may affect some internal >e.g. DPDK mempool creation.

You’re right. It was enough just to add 3 lines to the function for everything to work correctly:

static int32_t DeviceSetSocketID(uint16_t port_id, int32_t *socket_id)
{
    rte_errno = 0;
    int retval = rte_eth_dev_socket_id(port_id);
    *socket_id = retval;

#if RTE_VERSION >= RTE_VERSION_NUM(22, 11, 0, 0) // DPDK API changed since 22.11
    retval = -rte_errno;
#else
    if (retval == SOCKET_ID_ANY)
        retval = 0; // DPDK couldn't determine socket ID of a port
#endif

    return retval;
}

seems like I’ve nailed it down - if possible, try it with the newest master (soon to be 7.0) with >DPDK 22.11+.

The newest master (GitHub - OISF/suricata: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.) with dpdk 23.03.0 works fine (in IDS and IPS modes) without any code changes. In IPS mode trex shows speed: Total-Tx: 600 Mbps, Total-Rx: 560 Mbps

So, I can take the latest suricata release with the latest dpdk release.
Lukas, thank you very much!