2 ms·
Do you have NICs/FPGAs that this code could target or would those filters run on a CPU?
by wyldfire 9y ago
Do you have NICs/FPGAs that this code could target or would those filters run on a CPU?
- buro9 9y agoCPU presently. The filter expressions are based on the Wireshark Display Filters https://www.wireshark.org/docs/wsug_html_chunked/ChWorkBuildDisplayFilterSection.html https://www.wireshark.org/docs/wsug_html_chunked/ChWorkBuild... and we support everything except the slice operator. Rust handles the parsing, validation, AST creation, etc. That AST can then be applied to a trait table similar to the Wireshark implementation but without the necessity of a pcap step. I hope that the filter becomes an invariant form of filter against traffic and that once we've got the AST we can apply that filter to different places. Initially just to itself within a Rust matching engine at the edge, but if you have columns on a DB why not ask for a SQL expression derived from the filter expression and then filter a ClickHouse store using the same filter, and likewise as per your suggestion if we can take some of the expressions that aren't L7 why can't we have these run in the network card, etc. Right now... just CPU as it is early days. But eventually we can look at all places we match traffic and consider that a contender for the same filter to be applied there.