Project

General

Profile

Actions
Copy link

Feature #681

closed
EL EL

Implement TPACKET_V3 support in AF_PACKET

Feature #681: Implement TPACKET_V3 support in AF_PACKET

Added by Eric Leblond over 13 years ago. Updated about 10 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Eric Leblond
Target version:
3.1rc1
Effort:
Difficulty:
Label:

Description

Suricata only supports TPACKET_V2 in AF_PACKET capture. The version 3 of packet allows to have a non fixed packet size in the ring buffer. This is supposed to increase capture performance on network with small packets.

VJ Updated by Victor Julien about 13 years ago Actions
Copy link
 #1

  • Assignee set to Eric Leblond

Seems the protocol is not documented and example code is missing. Might be hard to get it working.

VJ Updated by Victor Julien over 12 years ago Actions
Copy link
 #2

  • Target version set to TBD

VJ Updated by Victor Julien over 12 years ago Actions
Copy link
 #3

  • Status changed from New to Assigned
  • Target version changed from TBD to 3.0RC2

VJ Updated by Victor Julien almost 12 years ago Actions
Copy link
 #4

  • Priority changed from Normal to Low
  • Target version changed from 3.0RC2 to TBD

Seems this API isn't all that much of an improvement?

EM Updated by Eoin Miller over 11 years ago Actions
Copy link
 #5

We noticed quite an increase in performance (around %25) when implementing in our sniffer. It would be great is Suricata was able to support this as well.

VJ Updated by Victor Julien over 11 years ago Actions
Copy link
 #7

Eoin, since you have an implementation, are you interested in contributing it?

VJ Updated by Victor Julien about 10 years ago Actions
Copy link
 #8

  • Priority changed from Low to Normal
  • Target version changed from TBD to 70

VJ Updated by Victor Julien about 10 years ago Actions
Copy link
 #9

  • Status changed from Assigned to Closed
  • Target version changed from 70 to 3.1rc1
Actions
Copy link

Also available in: PDF Atom