9 Commits (74f8302855b8a321f51a04091cafeb436defbbe9)

Author	SHA1	Message	Date
Lukas Sismis	ed47bf5dd8	dpdk: handle segmented mbufs in copy modes ... Packets received in segmented mbufs that cannot be linearized are inspected as a copy. In the copy modes (IPS/TAP), modifications made to the copy (inline stream normalization, the replace keyword) did not reach the mbufs, so the unmodified packet was forwarded. Chains larger than the maximum packet size were truncated for inspection but forwarded in full, and chains that could not be copied were forwarded uninspected. When Suricata modifies a copied packet, it now writes the data back to the mbuf chain before transmitting it. Chains that cannot be inspected in full or transmitted are dropped: chains larger than the maximum packet size, chains with more segments than the copy interface can transmit, and malformed chains. Forwarding chains requires the multi-segment TX offload, which replaces MBUF_FAST_FREE and selects a slower TX path on some NICs. As mbufs sized from the MTU rarely lead to chains on physical NICs, forwarding them is opt-in through the new tx-segmented-mbufs interface setting (default false), which both copy interfaces must share. Without it, chains that cannot be linearized are dropped in the copy modes. The drops are counted in capture.dpdk.segmented_drops and capture.dpdk.segmented_too_large. In IPS mode, they are also counted in ips.blocked with the new capture_error drop reason, so that the drop reasons explain the blocked packets. Ticket: 6012	6 days ago
Lukas Sismis	897cdb8571	doc/dpdK: update RX/TX descriptor note for Connect-X 4 ... Ticket: 7639	1 year ago
Lukas Sismis	6c654e30ac	threading: support previous threading configuration format ... Provide backward compatibility with the previous configuration format to allow smooth transition to the new format. The commit adds docs about the new format and the introduced changes.	1 year ago
Lukas Sismis	fbe5ce7a2b	dpdk: document vlan stripping offload ... Ticket: 5838	2 years ago
Lukas Sismis	640d0985c2	dpdk: check for link up before full startup ... ICE card (Intel E810) was not receiving packets immediatelly after startup, Suricata workers would act as processing while it was not. This eliminates the problem by only continuing in the initialization if the link is already up. The setting can be turned off manually from the configuraiton file. Ticket: 7381	2 years ago
Lukas Sismis	2ef2a9e26f	dpdk: auto configure Rx/Tx descriptors and mempool size ... Ticket: 7380 Ticket: 7373	2 years ago
Lukas Sismis	2a2898053c	dpdk: add interrupt (power-saving) mode ... When the packet load is low, Suricata can run in interrupt mode. This more resembles the classic approach of processing packets - CPU cores run low and only fetch packets on interrupt. Ticket: #5839	3 years ago
Lukas Sismis	ca6f7c2d00	dpdk: rework hugepage hints to use per-numa information ... Previous integration of hugepage analysis only fetched data from /proc/meminfo. However this proved to be often deceiving mainly for providing only global information and not taking into account different hugepage sizes (e.g. 1GB hugepages) and different NUMA nodes. Ticket: #6419	3 years ago
Lukas Sismis	11c3aa868d	doc: add DPDK Bond PMD docs ... Ticket: #6099	3 years ago