From 4be6701836580e2cbdc432f1f5d4ac54d1324c88 Mon Sep 17 00:00:00 2001 From: Eric Leblond Date: Sat, 6 Jul 2019 16:30:43 +0200 Subject: [PATCH] doc: pointer to bpfctrl As bpfctrl is currently the easiest way to manage pinned maps, let's point to it. We will switch doc to suricatacl once support has been added. --- doc/userguide/capture-hardware/ebpf-xdp.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/userguide/capture-hardware/ebpf-xdp.rst b/doc/userguide/capture-hardware/ebpf-xdp.rst index ef0c12c323..136e763acb 100644 --- a/doc/userguide/capture-hardware/ebpf-xdp.rst +++ b/doc/userguide/capture-hardware/ebpf-xdp.rst @@ -456,7 +456,7 @@ XDP and pinned-maps This option can be used to expose the maps of a socket filter to other processes. This allows for example, the external handling of a accept list or block list of -IP addresses. See `scbpf` tool avalable in the `ebpf/scpbf` directory for an example +IP addresses. See `bpfctrl `_ for an example of external list handling. In the case of XDP, the eBPF filter is attached to the interface so if you @@ -501,7 +501,7 @@ The eBPF filter `filter.bpf` uses a `ipv4_drop` map that contains the set of IPv If `pinned-maps` is set to `true` in the interface configuration then the map will be pinned under `/sys/fs/bpf/suricata-eth0-ipv4_drop`. -You can then use a tool to manage the IPv4 addresses in the map. +You can then use a tool like `bpfctrl` to manage the IPv4 addresses in the map. Hardware bypass with Netronome ------------------------------