Following is an initial attempt for discussion on
how to go ahead of integrating or using DPDK API in Suricata.
note: I am new to Suricata code flow, hence requesting for feedback and correction in choosing the steps.
Starting with suricata3.0, initial motivation was to use DPDK
tx_burst to allow line-rate capture and measure the threshold limit for single worker thread with limited zero-copy. The goal was to identify
- Identify the zero packet drop scenario for varying packet size.
- Run multiple instances in VM/dockers for scale up/down as demand.
- The maximum number of worker thread for 40Gbps processing.
The initial work started out on using Intel
e1000, which later got ported to
tap, ixgbe, i40e and vhost. Based on rule/signature addition we extend the filtering to RULE matched packet. Thus allowing packets to be forwarded to
copy-interface and worker thread process for matched rules. This allowed on high data rate scenario where there are no rules, packets simply gets into BYPASS mode and statistics updated.
Note: Current sample can be found with
https://github.com/vipinpv85/DPDK-Suricata_3.0/. Not all scenario is tested or validated too.
With release of suricata 4.1.1, goals were set for
- Full worker mode for multiple threads.
- Packet reassembly for ipv4/ipv6 fragments.
- Static HW-RSS with worker pinning.
- Deterministic flow to worker pining.
- Flatten MBUF for full zero-copy.
ongoing work can be found in