• 3-clause BSD license suits for the kernel,
• Designed to be as fast as possible,
• Tested on similar use cases with Suricata,
• Features: multi-pattern, logical combination, prefilter,
• Wire format for compiled patterns,
• Self-contained C runtime for scanning,
• No memory allocations on the datapath

Thelinux-rex module relies on the Hyperscan database serialization feature.Hyperscan is designed to be modular. Thelibhs_runtime.a providesthe regular expressions engine that loads a compiled expression andperforms the scanning.

Thelibhs.a module provides configuration facilities by compilingtextual representation of a regular expression into the database formatthe runtime can use.

The module doesn't support batch operations, as XDP doesn't provide that feature.

See theinstallation guide.

Refer tousage page.

Netdev 0x16, THE Technical Conference on Linux Networking