Suricata and dpdk in secondary mode

[zappasodi (zappasodi.dan)]

Hi Lukas,
many thanks for your feedback.

@lukashino

So you say, you have let’s say one interface from which you want to pass packets to both/multiple applications?

Yes, the first application is OVS with DPDK.
Have you ever tested OVS\dpdk with Suricata\dpdk?

@lukashino

I imagine your topology like this:

[IF] -> DPDK_APP1
     -> DPDK_Suricata

is it possible to apply this schema in IPS inline mode?
I would think to something like this:
[IF] → OVS → DPDK_APP1 → `DPDK_Suricata → …

and I was thinking to attach Suricata to a tap device
[IF] ↔ [OVS\DPDK] - [TAP] ↔ `Suricata ↔ …

but it is not working. In my system I can use tap and OVS with or without dpdk, that’s usually not a problem.
Do you know if Suricata supports tun\tap devices?
From my test it doesn’t seem to work even in a “normal” environment without dpdk.

@lukashino

look if a hardware TAP is possible

TAPI hardware is not possible.

@lukashino

try the secondary mode branch from my repo that was suggested earlier

I’m testing your branch.