[Top] [All Lists]

Re: [Fwd: [ANNOUNCE] Layer-7 Filter for Linux QoS]

To: Jamal Hadi <hadi@xxxxxxxxxxxxxxxx>
Subject: Re: [Fwd: [ANNOUNCE] Layer-7 Filter for Linux QoS]
From: Ethan Sommer <sommere@xxxxxxxxxxx>
Date: Tue, 20 May 2003 14:50:07 -0500
Cc: "David S. Miller" <davem@xxxxxxxxxx>, linux-net@xxxxxxxxxxxxxxx, netdev@xxxxxxxxxxx
In-reply-to: <20030520105356.U41173@xxxxxxxxxxxxxxxx>
References: <1053313298.3909.5.camel@xxxxxxxxxxxxx> <20030519202756.I39498@xxxxxxxxxxxxxxxx> <3EC9B815.4000504@xxxxxxxxxxx> <20030520080940.E40885@xxxxxxxxxxxxxxxx> <3ECA3E2C.20805@xxxxxxxxxxx> <20030520105356.U41173@xxxxxxxxxxxxxxxx>
Sender: netdev-bounce@xxxxxxxxxxx
User-agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4b) Gecko/20030515 Thunderbird/0.1a
Jamal Hadi wrote:

On Tue, 20 May 2003, Ethan Sommer wrote:

Nope. I need to strip out all the nulls from the packet, or any posix
regex parser will think the string ends at the first null. (so protocols
which use null's will be difficult/impossible to identify)

Ok, i see your dilema. How does snort do it? I dont think copying the
packet is the right way to do it. Could the null NOT be considered as
something speacial unless explicitly stated?

One thing I should have pointed out earlier, it only copies that memory/does regex stuff until it finds a match or the first 8 packets, whichever is less. So, at least based on my tests, it doesn't seem to slow down 100BT much from what it would be otherwise. We might run into trouble if we look at GB or 10GB, but until we find a problem with speed, I think it is probably more important to make this as simple and easy to maintain as possible. If we see a need to make it more complicated due to speed issues, _then_ we should think about trying to get rid of that copy.


<Prev in Thread] Current Thread [Next in Thread>