<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Good idea. Unfortunately, I dont control what gets bought here.<br><br>Thanks.<br><br><div>> Date: Mon, 7 Jul 2014 12:52:08 -0700<br>> From: cnelson@ucsd.edu<br>> To: coolyasha@hotmail.com; oisf-users@lists.openinfosecfoundation.org<br>> Subject: Re: [Oisf-users] Suricata Clustering<br>> <br>> -----BEGIN PGP SIGNED MESSAGE-----<br>> Hash: SHA1<br>> <br>> I would just buy an Arista switch and mirror the traffic to multiple<br>> servers.<br>> <br>> On 7/7/2014 12:36 PM, Yasha Zislin wrote:<br>> > Has anybody worked with Clustering multiple Suricata nodes to provide<br>> > High Availability and Fault Tolerance?<br>> > <br>> > I have two Suricata nodes and was thinking about implementing<br>> > Active/Standby cluster. After some research I came up with the following<br>> > idea.<br>> > Have standby Suricata disable promiscuous mode on monitoring NICs (SPAN<br>> > Ports). This way Suricata is running and I can (using a script) enable<br>> > promiscuous mode and have my monitoring.<br>> > <br>> > Here are the issues:<br>> > - Suricata doesnt work well when SPAN port nics have promiscious mode<br>> > disabled. For example, when trying to stop it (or restart it) it hangs<br>> > but eventually crashes with error ( <Error> - [ERRCODE:<br>> > SC_ERR_FATAL(171)] - Engine unable to disable detect thread -<br>> > "RxPFReth02". Killing engine)<br>> > - Suricata live rule reload doesnt work. It just hangs there forever.<br>> > <br>> > Is there a way to tell Suricata (without restarting its service) not to<br>> > store alerts on disk (ie unified2.alert)? Maybe that way it would be<br>> > considered standby and no alerts will be generated even though it sees<br>> > all of the traffic.<br>> > <br>> > Thanks.<br>> > <br>> > <br>> > _______________________________________________<br>> > Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>> > Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>> > List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br>> > OISF: http://www.openinfosecfoundation.org/<br>> > <br>> /<br>> <br>> - -- <br>> Cooper Nelson<br>> Network Security Analyst<br>> UCSD ACT Security Team<br>> cnelson@ucsd.edu x41042<br>> -----BEGIN PGP SIGNATURE-----<br>> Version: GnuPG v2.0.17 (MingW32)<br>> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/<br>> <br>> iQEbBAEBAgAGBQJTuvpoAAoJEKIFRYQsa8FWZhgH+MNO1LrOVQ2VwU1ndPMQf9zt<br>> e5xUAtcAOsgVQ6HA2uCwmtNFzQiEQ13qctED1ojFPt/rjQXU1OCKR+wVLYhlLHjb<br>> OOSt3cvg1D5y20++OcIz0e+gj/8hCIOaJWZH8OMvfKiWqJjnnig4k+yTlRFthupI<br>> dt+W/QU5CI+n8TQ9AJ5DCfCMvKgiPqy0beo4Dn6n76704mAqZQHtU+vVzNvDCznt<br>> V9NrdUf593Ql7Hq7gkvtjmhf5JoI9TXA+I9z/0k7H5Rg0Xy4R4B6XIaw9/9AP5tA<br>> S7tlwjO8fUNR43GOz1pcM2XdrvVF37eTHKOWqmapVNJ8iPsKw129OkkVsfl4UA==<br>> =6ITH<br>> -----END PGP SIGNATURE-----<br></div> </div></body>
</html>