|
|
|
|
@ -260,13 +260,13 @@ also use the ``/etc/suricata/ebpf/xdp_filter.bpf`` (in our example TCP offloadin
|
|
|
|
|
ring-size: 200000
|
|
|
|
|
# Uncomment the following if you are using hardware XDP with
|
|
|
|
|
# a card like Netronome
|
|
|
|
|
# no-percpu-hash: yes
|
|
|
|
|
# use-percpu-hash: no
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
XDP bypass is compatible with AF_PACKET IPS mode. Packets from bypassed flows will be send directly
|
|
|
|
|
from one card to the second card without going by the kernel network stack.
|
|
|
|
|
XDP bypass is compatible with AF_PACKET IPS mode. Packets from bypassed flows will be send directly
|
|
|
|
|
from one card to the second card without going by the ker nel network stack.
|
|
|
|
|
|
|
|
|
|
If you are using hardware XDP offload you may have to use the ``no-percpu-hash`` function and
|
|
|
|
|
If you are using hardware XDP offload you may have to set ``use-percpu-hash`` to false and
|
|
|
|
|
build and install the XDP filter file after setting ``USE_PERCPU_HASH`` to 0.
|
|
|
|
|
|
|
|
|
|
Intel NIC setup
|
|
|
|
|
|