Project

General

Profile

Actions

Feature #5673

open

capture: option to decapsulate everything first

Added by Philippe Antoine 3 months ago. Updated 3 months ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

before computing flow hashes, because some case, every network traffic is encapsulated in only one flow/GRE tunnel


Related issues 2 (2 open0 closed)

Related to Task #5488: Suricon 2022 brainstormAssignedVictor JulienActions
Related to Optimization #2725: stream/packet on wrong threadFeedbackOISF DevActions
Actions #1

Updated by Philippe Antoine 3 months ago

  • Related to Task #5488: Suricon 2022 brainstorm added
Actions #2

Updated by Victor Julien 3 months ago

Actions #3

Updated by Victor Julien 3 months ago

  • Subject changed from Option to decapsulate everything first to capture: option to decapsulate everything first

I think this was about providing ways to decapsulate tunnels at the capture stage, esp before RSS hashing. So this would mean capture specific support, like a special eBdf program in af-packet.

Actions

Also available in: Atom PDF