Hello.
Do you think it's possible to use pf_ring ZC for feeding packets to
two completely different NSM applications? Like, I'd like to use Bro
and Suricata on the same sensor, single network port. Each application
would get the same network packets and would do per-flow load
balancing among its own threads (Suricata) or processes (Bro).
The packet flow would look like this:
card --> userspace_buffer -> Suricata -> N threads
-> Bro -> M processes
With M != N (or the same, if necessary).
Various applications in examples_zc directory do some part of it, but
not exactly what I do (unless I don't know how to use them). It's
basically a fan-out between applications and IP-hashing later. A two
step processing.
Is that even possible with ZC (it is with a traditional pf_ring, i.e.
without DNA/ZC)?
What would be the performance impact?
_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop
