<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yiv3874734568"><div id="yui_3_16_0_1_1444311546408_27015"><div style="color:#000;background-color:#fff;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px;" id="yui_3_16_0_1_1444311546408_27014"><div id="yiv3874734568"><div id="yiv3874734568yui_3_16_0_1_1444311546408_21325"><table id="yiv3874734568yui_3_16_0_1_1444311546408_21324" cellspacing="0" cellpadding="0" border="0"><tbody id="yiv3874734568yui_3_16_0_1_1444311546408_21323"><tr id="yiv3874734568yui_3_16_0_1_1444311546408_21322"><td colspan="1" rowspan="1" valign="top" id="yiv3874734568yui_3_16_0_1_1444311546408_21321">Sorry for the quick reply yeaterday, I forgot to hit Reply All.<div id="yiv3874734568yMail_cursorElementTracker_0.09719834546558559"><br clear="none"></div><div id="yiv3874734568yMail_cursorElementTracker_0.09719834546558559">As for the tuning, I know my current, underpowered Suricata system is missing events, as is my new hardware/configuration. I base this on some attack traffic I saw from one IP yesterday. </div><div id="yiv3874734568yMail_cursorElementTracker_0.09719834546558559"><br clear="none"></div><div id="yiv3874734568yMail_cursorElementTracker_0.09719834546558559" dir="ltr">So our configuration is a front end router feeding an inline IPS which then is tapped - one tap to my old Suricata system and the second to my new Suricata system. From a full take packet capture I see 45 attempts to issue malicious POST attempts to a webserver we have. My original Suricata system triggered on 10 of those while my new Suricata triggered on 15. I then took the pcap I extracted and ran it through Suricata on the new system and that system showed it trigger on all 45. So that's giving me a feeling that I'm not tuning something correct - causing the running Suricata to miss things.</div><div id="yiv3874734568yMail_cursorElementTracker_0.09719834546558559"> <hr id="yui_3_16_0_1_1444311546408_27054"><table id="yiv3874734568yui_3_16_0_1_1444311546408_21320" cellspacing="0" cellpadding="0" border="0"><tbody id="yiv3874734568yui_3_16_0_1_1444311546408_21319"><tr id="yiv3874734568yui_3_16_0_1_1444311546408_21318"><td colspan="1" rowspan="1" valign="top" id="yiv3874734568yui_3_16_0_1_1444311546408_21317"> <div id="yiv3874734568yui_3_16_0_1_1444311546408_21316" style="font-family:Roboto, sans-serif;color:#7e7d80;"><b>From</b>:"Rob MacGregor" <rob.macgregor@gmail.com><br clear="none"><b>Date</b>:Fri, Oct 9, 2015 at 5:14 AM<br clear="none"><b>Subject</b>:Re: [Oisf-users] Help with good configuration for Suricata install with Napatech card<br clear="none"><br clear="none"></div> <div class="yiv3874734568qtdSeparateBR" id="yui_3_16_0_1_1444311546408_27095"><br clear="none"><br clear="none"></div><div class="yiv3874734568yqt4693023694" id="yiv3874734568yqt51879"><div class="yiv3874734568yqt6114859608" id="yiv3874734568yqt12449"><div dir="ltr" id="yiv3874734568yui_3_16_0_1_1444311546408_21885"><div class="yiv3874734568gmail_quote" id="yiv3874734568yui_3_16_0_1_1444311546408_21884"><div dir="ltr" id="yiv3874734568yui_3_16_0_1_1444311546408_21883">On Thu, Oct 8, 2015 at 10:50 PM Stephen Castellarin <<a rel="nofollow" shape="rect" id="yui_3_16_0_1_1444311546408_27031" href="">castle1126@yahoo.com</a>> wrote:<br clear="none"></div><blockquote class="yiv3874734568gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;" id="yui_3_16_0_1_1444311546408_27096">Hey Rob,<br clear="none"></blockquote><div id="yui_3_16_0_1_1444311546408_27097"> </div><div id="yui_3_16_0_1_1444311546408_27098">Don't forget to include the list ;)</div><div id="yui_3_16_0_1_1444311546408_27099"><br clear="none"></div><blockquote class="yiv3874734568gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;" id="yui_3_16_0_1_1444311546408_27100">
Right now Suricata is configured for autofp. The ntservice.ini is the default that came out of the driver install. As for packet loss I know previously that with a 1Gb ethernet card I know that our tap infrastructure kept alerting that we were over-subscribing on the amount of traffic hitting the Suricata port. It's hard to quantify what the packet loss on the current production system is - every time I run an ifconfig on that interface the dropped count continues to rise at a good clip. Running "monitoring" on the new server shows 0 fragments, collisions, drop events or crc/align errors.<br clear="none"></blockquote><div><br clear="none"></div><div>Hmmm, my Napatech install doesn't show up as an interface, so I can't cross-check that. However, if the monitoring tool isn't reporting packet loss, that's a good sign.</div><div><br clear="none"></div><div>So, what do you expect/want to get "tuned up"?</div><div><br clear="none"></div><div>Also, are you really sure those 24K rules are relevant? That's quite a large ruleset...</div><div class="yiv3874734568yQTDBase yiv3874734568yqt6512462772" id="yiv3874734568yqtfd98836"><div><br clear="none"></div><div>-- </div><div> Rob </div></div></div></div></div></div></td></tr></tbody></table></div></td></tr></tbody></table></div></div></div></div></div></div></body></html>