Project

General

Profile

Actions

Feature #3306

closed
EL RM

Support AF_XDP capture method

Feature #3306: Support AF_XDP capture method

Added by Eric Leblond over 6 years ago. Updated over 3 years ago.

Status:
Closed
Priority:
Normal
Target version:
Effort:
medium
Difficulty:
high
Label:

Description

A new capture method has been recently introduced in Linux. Named AF_XDP, it allows to capture the traffic with a kernel bypass. This limit the cost of the capture in term of CPU cycle.


Related issues 2 (2 open0 closed)

Related to Suricata - Task #3288: Suricon 2019 brainstormAssignedVictor JulienActions
Related to Suricata - Task #4097: Suricon 2020 brainstormAssignedVictor JulienActions

EL Updated by Eric Leblond over 6 years ago Actions #1

Beginning of implementation using libbpf: https://github.com/regit/suricata/tree/af-xdp-v2

EL Updated by Eric Leblond over 6 years ago Actions #2

  • Parent task set to #3288

VJ Updated by Victor Julien over 6 years ago Actions #3

  • Status changed from New to Assigned
  • Assignee set to Eric Leblond
  • Target version set to TBD

Set target to TBD as we are waiting for the kernel to provide us with timestamp support.

VJ Updated by Victor Julien over 6 years ago Actions #4

  • Parent task deleted (#3288)

VJ Updated by Victor Julien over 6 years ago Actions #5

  • Related to Task #3288: Suricon 2019 brainstorm added

VJ Updated by Victor Julien over 5 years ago Actions #6

  • Related to Task #4097: Suricon 2020 brainstorm added

VJ Updated by Victor Julien over 4 years ago Actions #7

  • Status changed from Assigned to In Progress

EL Updated by Eric Leblond over 3 years ago Actions #8

AF_XDP functions in libbpf have been moved to xdp-tools (https://github.com/xdp-project/xdp-tools) which means we need to update the build system and use the new functions.

VJ Updated by Victor Julien over 3 years ago Actions #9

  • Status changed from In Progress to In Review
  • Assignee changed from Eric Leblond to Richard McConnell
  • Target version changed from TBD to 7.0.0-rc1

VJ Updated by Victor Julien over 3 years ago Actions #10

  • Status changed from In Review to Closed
Actions

Also available in: PDF Atom