Questions on Suricata and DPDK

[Chelsea_Robinson]

I have watched this video, but did not fully understood the DPDK details:

Suricata and DPDK: Everything You Need to Know

We have a DPDK environment where traffic has allow/block rules based on a variety of parameters. Also, we have two tenants. Some of our traffic needs to go through Suricata and some doesn’t go through Suricata, and we have logic to send traffic to 1 of 2 Suricata tenants. Is that something that could be done right now? I’m not clear after watching that video.

Thank you

[lukashino (Lukas Sismis)]

@Chelsea_Robinson

We have a DPDK environment where traffic has allow/block rules based on a variety of parameters

I think I am missing details on this one. I assume your “DPDK environment” is some sort of switch/router which decides where to send the traffic. If the DPDK environment has some (virtual) interface then you should be able to connect Suricata(s) to it.

Overall, I would need more info about your architecture to say confidently.