Suricata using dpdk and running other software like zeek at the same time

Hi duda,

while I haven’t explored this area properly here are some of my insights:

  • one of the easiest solutions might be actually using a second port and enabling port mirroring on the switch (if the environment and requirements allow it)
  • for software-based solutions, the whole application stack needs to run on DPDK. If it is ok then I would explore:
    • VPP and memif - there was somebody in the community who experimented with this, I think it might be a viable option.
    • OpenVSwitch - it runs on DPDK but it doesn’t seem to distribute the traffic directly to DPDK apps - so probably not an option.
    • DPDK ring virtual device: https://doc.dpdk.org/guides/nics/pcap_ring.html#rings-based-pmd I think this could be quite well oriented on the performance though you would lose some advanced management capabilities. This allows you to connect two applications together with a ring buffer. I would probably first test the idea with 2 instances of testpmd applications and only move forward if it would be actually working. More experimental approach. In the solution, the intermediate applications could be running in an inline mode and hand packets to each other. The last application would then be the “sink”, freeing the incoming packets back to the device mempool.

EDIT:
Here is the link to the discussion I mentioned: