suricata中DPDK收发包

最新推荐文章于 2025-06-08 09:03:55 发布

finlay_xing

最新推荐文章于 2025-06-08 09:03:55 发布

阅读量485

点赞数 10

CC 4.0 BY-SA版权

文章标签： java 服务器前端

本文链接：https://blog.csdn.net/finley_feng/article/details/139501637

DPDK的收包也是增加了runmode-dpdkintel.c和source-dpdkintel.c两个文件

suricata.c中调用关系

main --> RunModeRegisterRunModes() --> RunModeDpdkIntelRegister()

void RunModeDpdkIntelRegister(void)
{
#ifdef HAVE_DPDKINTEL
    default_mode = "workers";
    RunModeRegisterNewRunMode(RUNMODE_DPDKINTEL, "workers",
            "Workers DpdkIntel mode, each thread does all"
            " tasks from decoding to logging. Acquistion is "
            " done by seperate core per interface",
            RunModeDpdkIntelWorkers);
#endif /* HAVE_DPDKINTEL */
}

注册了RunModeIdsDpdkWorkers函数

main -->ParseInterfacesList
-->LiveBuildDeviceList
-->LiveBuildDeviceListCustom
-->LiveRegisterDeviceName（读取所有DPDK配置的pcie地址接口，放到pre_live_devices链表中）

#ifdef HAVE_DPDKINTEL
    } else if (run_mode == RUNMODE_DPDKINTEL) {
        if (strlen(pcap_dev)) {
                fprintf(stderr, "ERROR: DPDK Intel is not supported for PCAP\n");
                SCReturnInt(TM_ECODE_FAILED);
        } else {
            int ret = LiveBuildDeviceList("dpdkintel.inputs");
            if (ret == 0) {
                fprintf(stderr, "ERROR: No interface found for DPDK Intel\n");
                SCReturnInt(TM_ECODE_FAILED);
            }
        }
#endif /* HAVE_DPDKINTEL */

main -->PostConfLoadedSetup
-->LiveDeviceFinalize
-->LiveRegisterDevice（遍历pre_live_devices链表，读取pcie地址到live_devices链表中，后续提供网口pcie相关的函数都是从live_devices链表获取，比如LiveGetDeviceCount）
-->RegisterAllModules
--&g