Re: [Snort-inline-users] Detecting that an IP flow has passed all rules

[Roland T. (SourceForge) <raz...@co...>]

Bert van Leeuwen said:


> The only alternative to the IPQ_COPY_PACKET mode is the IPQ_COPY_META
> mode,  which allows the userspace program to only access the metadata
> of the packet  (not very useful for content based filtering).
>
> It would be nice if there were an IPQ_MMAP_PACKET mode too, and, as you
>  mentioned, a mode where several packets can be batched at once to also
> save  thread context switches.


Urk! You are quite right, it is copying to a user-allocated buffer and, I
agree, an MMAP option would offer some performance an improvement.

- Raz