| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <4E019097.7090703@inliniac.net> Date: Wed, 22 Jun 2011 08:49:59 +0200 From: Victor Julien <victor@...iniac.net> To: Changli Gao <xiaosuo@...il.com> CC: David Miller <davem@...emloft.net>, netdev@...r.kernel.org Subject: Re: [RFC PATCH] packet: Add fanout support. On 06/22/2011 03:44 AM, Changli Gao wrote: > On Wed, Jun 22, 2011 at 5:39 AM, David Miller <davem@...emloft.net> wrote: >> From: Victor Julien <victor@...iniac.net> >> Date: Tue, 21 Jun 2011 15:27:54 +0200 >> >>> From a Suricata IDS point of view, I would need to have the >>> fragments of a flow/tuple on the same socket. >> >> Currently you would, they would all go to the first socket in >> the fanout. >> > > I think he also needs all the packets belong to the related > connections are received via the same socket. I am afraid that he has > to dispatch these kind of packets among the uesrland processes again. > :) > Indeed. Although in Suricata we *could* work around it as we distribute the flows over threads, not processes. It would still be messy. For this to be useful to a tool like Snort (I'm sure they're interested) I think this would be a deal breaker. -- --------------------------------------------- Victor Julien http://www.inliniac.net/ PGP: http://www.inliniac.net/victorjulien.asc --------------------------------------------- -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists