Re: Snort/daq MPI

Hi Carter,


Thanks for getting back. It was more of curiosity while reading Cisco's documentation of the UCS C Series servers. They have a feature they call usNIC (user-space NIC), in which packets completely bypass the kernel from the NIC to the configured user-space application. To an extent, this sounded similar to PF_RING and probably netmap (not sure about load balancing packets), so I thought why not use usNIC with Snort! I am still familiarizing myself with the concept.


Here is the documentation link, look specifically at pages 163-164:


http://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/c/sw/gui/config/guide/2-0/b_Cisco_UCS_C-series_GUI_Configuration_Guide_201.pdf


Sorry don't have more to share.

YM

________________________________
From: Carter Waxman (cwaxman) <[email protected]>
Sent: Wednesday, February 24, 2016 1:40 PM
To: Y M; snort-devel mailinglist
Subject: Re: [Snort-devel] Snort/daq MPI

Hi,

We currently don't have MPI support, however it sounds like it could be an interesting project if you want to take it on. Messaging latency would probably affect your performance, but then again it depends on what exactly its being used to parallelize and how you split your nodes (I'm actually a little curious if you wouldn't mind sharing).

If you're looking for something a little more turn-key, take a look at Snort 3 as we already support multithreading for multiple interfaces.

-Carter

From: Y M <[email protected]<mailto:[email protected]>>
Date: Tuesday, February 23, 2016 at 5:11 PM
To: snort-devel mailinglist <[email protected]<mailto:[email protected]>>
Subject: Re: [Snort-devel] Snort/daq MPI

*appropriated is actually appreciated. I blame autocorrect!

Sent from Mobile

_____________________________
From: Y M <[email protected]<mailto:[email protected]>>
Sent: Wednesday, February 24, 2016 12:58 AM
Subject: [Snort-devel] Snort/daq MPI
To: snort-devel mailinglist <[email protected]<mailto:[email protected]>>


Hello,

Does Snort/daq support compiling against the Message Passing Interface? As I understand it so far, the application has to support it or am I completely off?!
I didn't not find the MPI headers in the sources which tells me it's not supported. Resources available on the net are mostly academic so far.

Any pointers are appropriated

Thanks
YM

------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=272487151&iu=/4140

_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!