Skip to content

Snort network intrusion detection system with GPU/OpenCL packet processing

License

Unknown, Unknown licenses found

Licenses found

Unknown
LICENSE
Unknown
COPYING
Notifications You must be signed in to change notification settings

viren-nadkarni/bvd-snort

Repository files navigation

bvd-snort

Snort fork with OpenCL/GPGPU-based packet processing engine

Info

Project = Snort++
Binary = snort
Version = 3.0.0-a4 build 235
Base = 2.9.8 build 383

The Aho-Corasick pattern search algorithm has been implemented in OpenCL and can be used by specifying ac_gpu as search_method in config. The new engine is just a prototype and is not fully integrated into Snort yet. For example, logging and alerts do not work. There are also some issues with false positives when using more complex rulesets.

Requirements

If OpenCL is not detected by the system (check with clinfo), then setup Mali driver:

sudo apt install mali-fbdev
sudo mkdir -p /etc/OpenCL/vendors
sudo bash -c 'echo "/usr/lib/arm-linux-gnueabihf/mali-egl/libOpenCL.so" > /etc/OpenCL/vendors/armocl.icd'

Building

export build_path=~/snort_build
mkdir -p $build_path

./configure_cmake.sh --prefix=$build_path
cd build && make -j $(nproc) install

or simply use the helper scripts:

. env.sh
./build.sh

If build fails with fatal error: dnet/sctp.h: No such file or directory:

sudo cp ~/libdnet/include/dnet/* /usr/local/include/dnet/

Running

export LUA_PATH=$build_path/include/snort/lua/\?.lua\;\;
export SNORT_LUA_PATH=$build_path/etc/snort

$build_path/bin/snort -c snort.lua -R test.rules -r ~/smallFlows.pcap

Use appropriate paths. Sample pcap files are available here.


License: GPLv2

About

Snort network intrusion detection system with GPU/OpenCL packet processing

Resources

License

Unknown, Unknown licenses found

Licenses found

Unknown
LICENSE
Unknown
COPYING

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published