[$] Using eBPF and XDP in Suricata

Post Syndicated from jake original https://lwn.net/Articles/737771/rss

Much software that uses the Linux kernel does so at comparative
arms-length: when it needs the kernel, perhaps for a read or write, it
performs a system call, then (at least from its point of view) continues
operation later, with whatever the kernel chooses to give it in reply. Some
software, however, gets pretty intimately involved with the kernel as part
of its normal operation, for example by using eBPF for low-level packet
processing. Suricata is such a program; Eric Leblond
spoke about it at Kernel Recipes 2017 in a talk entitled “eBPF and XDP
seen from the
eyes of a meerkat”.