Re: Snort 3 per DAQ-instance variables

[Y M via Snort-devel <snort-devel () lists snort org>]

Thank you, Michael.
________________________________
From: Snort-devel <snort-devel-bounces () lists snort org> on behalf of Michael Altizer (mialtize) via Snort-devel 
<snort-devel () lists snort org>
Sent: Saturday, July 25, 2020 9:33 PM
To: snort-devel () lists snort org <snort-devel () lists snort org>
Subject: Re: [Snort-devel] Snort 3 per DAQ-instance variables

Yes, I removed that functionality with the switch to libdaq3 earlier last year.  I didn't have a compelling use case 
for it anymore and it overcomplicated things a lot.  Most of what it would have previously been used for was solved by 
providing an instance ID/instance total to the DAQ module instantiation instead.  The libdaq3 library still supports 
the flexibility should we ever need to bring back that level of granularity in DAQ module configuration.

On 7/22/20 6:48 AM, Y M via Snort-devel wrote:
It looks like overriding individual DAQ-instance variables was removed as some point since the 'instances' 
configuration is no longer available. Does this mean that there is no need or ability to configure them? Looking at the 
current configurable items, variables are only applicable globally.  I don't have specific use-case, just trying to 
understand. For example, it was possible to configure DAQ such as:

daq = {
 module_dirs = {
 '/usr/local/lib/daq'
    },
 module = 'afpacket',
 input_spec = 'ens192',
 variables = {
 'lb_total=2',
 'fanout_type=hash'
    },
 instances = {
        {
             id = 0,
            variables = {
                'lb_id=1'
            }
        },
        {
            id = 1,
            variables = {
                'lb_id=2'
            }
        }
    }
}

Thank you.
YM



_______________________________________________
Snort-devel mailing list
Snort-devel () lists snort org<mailto:Snort-devel () lists snort org>
https://lists.snort.org/mailman/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!


_______________________________________________
Snort-devel mailing list
Snort-devel () lists snort org
https://lists.snort.org/mailman/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!