<!DOCTYPE html PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'>
<html><head><meta http-equiv="Content-Type" content="text/html;charset=us-ascii">
<style>BODY{font:10pt Tahoma,Verdana,sans-serif} .MsoNormal{line-height:120%;margin:0}</style></head><body>
Are you saying that NFQUEUE is not working so well in 2.0.9 so we should not use that IPS mode?<br><br>Leonard Jacobs<br><blockquote style="padding-left: 5px; margin-left: 5px; border-left: #0000ff 2px solid; margin-right: 0px"><hr><b>From:</b> Eric Leblond [mailto:eric@regit.org]<br><b>To:</b> Leonard Jacobs [mailto:ljacobs@netsecuris.com], oisf-users@lists.openinfosecfoundation.org [mailto:oisf-users@lists.openinfosecfoundation.org]<br><b>Sent:</b> Fri, 13 Nov 2015 07:37:51 -0600<br><b>Subject:</b> Re: [Oisf-users] AF_Packet Mode vs. NFQUEUE Mode<br><br>Hello Leonard,<br>
<br>
On Fri, 2015-11-13 at 07:08 -0600, Leonard Jacobs wrote:<br>
> What happens if the interfaces are bridged when using AF_Packet mode?<br>
> Does that cause problems since this mode performs its own copy-mode<br>
> between interfaces?<br>
<br>
That would cause a duplication of packets:<br>
* Bridge forward packets from iface 1 to 2<br>
* Suricata see packets on iface 1 and copy packets on iface 2<br>
<br>
> In NFQUEUE IPS mode, are the interfaces supposed to be bridged? Will<br>
> IPTables not function properly without the interfaces being bridged?<br>
<br>
No bridge needed. Using it is even the buggiest setup that can be done<br>
(currently unexplained packets loss in that mode).<br>
<br>
BR,<br>
<br>
> Thanks.<br>
> <br>
> Leonard Jacobs<br>
> <br>
> <br>
> <br>
> <br>
> <br>
> <br>
> <br>
> _______________________________________________<br>
> Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a><br>
> Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/supp" target="_blank">http://suricata-ids.org/supp</a><br>
> ort/<br>
> List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-u" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-u</a><br>
> sers<br>
> Suricata User Conference November 4 & 5 in Barcelona: <a href="http://oisfeven" target="_blank">http://oisfeven</a><br>
> ts.net<br>
-- <br>
Eric Leblond <<a href="mailto:eric@regit.org">eric@regit.org</a>><br>
Blog: <a href="https://home.regit.org/" target="_blank">https://home.regit.org/</a><br>
<br>
<br>
</blockquote><style>
</style>
</body></html>