New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
devguide/internals: kickstart packet pipeline chapter - v1 #8793
Conversation
Codecov Report
Additional details and impacted files@@ Coverage Diff @@
## master #8793 +/- ##
==========================================
- Coverage 82.18% 82.14% -0.05%
==========================================
Files 969 969
Lines 272739 272739
==========================================
- Hits 224164 224036 -128
- Misses 48575 48703 +128
Flags with carried forward coverage won't be shown. Click here to find out more. |
The pipeline either runs in a single thread (runmode *single* or *workers*) or | ||
split in 2 stages (*autofp*). | ||
|
||
A pipeline is created by Suricata's ``RunMode`` and stored in per thread |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
runmodes are defined by the capture method (e.g. runmode-af-packet.c), but generally implement only 3 predefined modes: workers, autofp, single
=============== | ||
|
||
- Packet Pool | ||
- Packet Capture Module |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
gets a packet from the NIC
|
||
- Packet Pool | ||
- Packet Capture Module | ||
- Packet Decode Module |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
decodes the packet, starting with a capture method specific decoder, then calling into the generic suricata packet decoders like decode-ethernet.c and decode-ipv4.c
- Packet Pool | ||
- Packet Capture Module | ||
- Packet Decode Module | ||
- Flow Worker Module (check the *Engines* chapter for more) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
runs the main tracking, detection and logging loop:
- flow handling
- TCP stream
- app-layer parsing
- detect
- output / logging
Work continues in #8813 |
Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/6030
Describe changes:
TODO:
-- add references to related modules once names are defined