Snort mailing list archives
Re: Snort 3 per DAQ-instance variables
From: "Michael Altizer \(mialtize\) via Snort-devel" <snort-devel () lists snort org>
Date: Sat, 25 Jul 2020 18:33:27 +0000
Yes, I removed that functionality with the switch to libdaq3 earlier last year. I didn't have a compelling use case for it anymore and it overcomplicated things a lot. Most of what it would have previously been used for was solved by providing an instance ID/instance total to the DAQ module instantiation instead. The libdaq3 library still supports the flexibility should we ever need to bring back that level of granularity in DAQ module configuration. On 7/22/20 6:48 AM, Y M via Snort-devel wrote: It looks like overriding individual DAQ-instance variables was removed as some point since the 'instances' configuration is no longer available. Does this mean that there is no need or ability to configure them? Looking at the current configurable items, variables are only applicable globally. I don't have specific use-case, just trying to understand. For example, it was possible to configure DAQ such as: daq = { module_dirs = { '/usr/local/lib/daq' }, module = 'afpacket', input_spec = 'ens192', variables = { 'lb_total=2', 'fanout_type=hash' }, instances = { { id = 0, variables = { 'lb_id=1' } }, { id = 1, variables = { 'lb_id=2' } } } } Thank you. YM _______________________________________________ Snort-devel mailing list Snort-devel () lists snort org<mailto:Snort-devel () lists snort org> https://lists.snort.org/mailman/listinfo/snort-devel Please visit http://blog.snort.org for the latest news about Snort!
_______________________________________________ Snort-devel mailing list Snort-devel () lists snort org https://lists.snort.org/mailman/listinfo/snort-devel Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- Snort 3 per DAQ-instance variables Y M via Snort-devel (Jul 22)
- Re: Snort 3 per DAQ-instance variables Michael Altizer (mialtize) via Snort-devel (Jul 25)
- Re: Snort 3 per DAQ-instance variables Y M via Snort-devel (Jul 27)
- Re: Snort 3 per DAQ-instance variables Michael Altizer (mialtize) via Snort-devel (Jul 25)