At Black Hat USA 2026, DYNANIC demonstrated Suricata IDS acceleration at 400 Gbps. From August 4 to 6, our team ran the live demo in Startup City at booth 6215. The event took place at the Mandalay Bay Convention Center in Las Vegas.
The setup combined the DYNANIC platform with a Silicom ThunderFjord SmartNIC and an Altera Agilex FPGA. It showed how hardware flow offload can reduce CPU pressure while Suricata focuses on traffic that needs deep inspection. This post covers the demo, the performance results, why the approach matters above 100 Gbps, and where to find the technical details.
What we had at booth 6215
The demo inspected traffic at 400 Gbps with Suricata IDS. DYNANIC accelerated the inspection path on a Silicom ThunderFjord SmartNIC with an Altera Agilex FPGA.
Two results stood out:
- 70% lower CPU load on the inspection path. The platform moved flow filtering from the CPU into the network card.
- 5x smaller hardware footprint than standard solutions for the same inspection workload.
DPDK and RTE Flow drive the offload. Suricata selects traffic for filtering, and the platform pushes that decision into the network card. Traffic that does not need inspection then bypasses the CPU. This removes a critical throughput bottleneck.
Ready to test hardware acceleration in your environment?
Why Suricata IDS acceleration matters above 100 Gbps
An intrusion detection engine that cannot keep up with the line rate does not fail cleanly. It drops packets, and the packets it drops are selected by the capture path rather than by a security policy. Traffic, including potentially malicious traffic, may pass uninspected, and the operator has limited visibility into what was missed.
The conventional answer is horizontal scale: more servers, more cores, more licenses, more rack space, and more power. That answer becomes difficult to defend at 400 Gbps, where the per-packet CPU budget is measured in nanoseconds.
Filtering in hardware changes the ratio. Traffic that does not require inspection – backup replication, management VLANs, post-handshake encrypted sessions, and elephant flows – never reaches the CPU at all. The processing capacity that remains is spent on the connections that actually warrant deep inspection. Suricata continues to track offloaded flows through the hardware connection table, so filtering reduces load without creating blind spots.
Suricata Turbo at Black Hat Arsenal
DYNANIC DPDK and Suricata IDS Expert Lukáš Šišmiš presented Suricata Turbo: Let Your NIC Drop the Flows Suricata Won’t Miss at Black Hat Arsenal.
Suricata Turbo extends Suricata IDS with a hardware flow offload engine. Suricata already includes a software optimization that drops uninteresting traffic early in the processing chain, but the CPU still touches every packet, even when the decision is to ignore it. It has been validated on NIC platforms from multiple vendors, including Intel, NVIDIA, and DYNANIC, with no proprietary SDK required. The code is available at github.com/DynaNIC/suricata-turbo.
What engineers asked us at booth
Booth 6215 drew steady traffic across both days, including engineers and product leads from a number of companies building cybersecurity at scale. Three topics came up repeatedly.
CPU cannot keep up
We heard that in almost every technical conversation opened at Black Hat. Several teams had already hit the ceiling inside 100G, where adding cores stopped producing proportional gains and the pipeline began dropping packets. That matters because loss in an inspection tier is a detection statistic rather than a performance one: roughly 3 percent loss costs about 10 percent of detection visibility.
We described engineering principles for the 400G era in THIS article.
Vendor neutrality is crucial for cybersecurity companies
The situation has changed in the last few years. Security vendors ship to customers who have already chosen their hardware, so an acceleration layer that works on one FPGA card limits the addressable deployment base. The sharper version was roadmap dependency. On a fixed-function ASIC, a needed offload can sit a year away on someone else’s release schedule.
Our answer is structural. Suricata Turbo runs on Intel, NVIDIA, and DYNANIC cards with no proprietary SDK in the path, across FPGA silicon from Altera, AMD, and Achronix. Because the pipeline is FPGA rather than fixed silicon, the logic stays reprogrammable as detection needs change, on the same card, with no HDL recompile.
DPDK is highly relevant in 2026
DPDK has become the layer through which hardware capability reaches applications, which makes rte_flow the practical control plane for acceleration. Everything on our stand is driven through it.
What engineers wanted to discuss was the gap between the specification and the hardware. Pavlína Patová presented our benchmarking on exactly that at DPDK Summit 2026, comparing rte_flow offload behavior across NVIDIA ConnectX-5, Intel E810, and a Silicom N6010: API conformance is not behavioral consistency. Read more about it HERE.
More on accelerating Suricata at 100G and beyond
Lukáš Šišmiš and DYNANIC CSO Jan Kořenek joined Scott Schweitzer on the SmartNICs Today podcast for a longer discussion of high-speed IDS performance. The episode covers How FPGA-based SmartNICs and hardware-software co-design accelerate Suricata, and where CPU scaling stops working at 100G, 400G, and beyond
Listen to the Episode 4 on SmartNICs Today
Scott Schweitzer has also covered the topic in his LinkedIn post: High-speed IDS breakthrough: optimizing Suricata.
If we did not get the chance to talk
If you were at Black Hat USA 2026 and did not manage to reach the booth, or you are reading this from somewhere other than Las Vegas, you can book time with the DYNANIC CTO directly or contact DYNANIC via online form or email info@dyna-nic.com.
