<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"TIM Sans";
panose-1:0 0 5 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.StileMessaggioDiPostaElettronica17
{mso-style-type:personal-compose;
font-family:"TIM Sans","serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 2.0cm 2.0cm 2.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="IT" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">Hello everyone. We installed Suricata 3.1 (stable) with PF_RING 6.4.0 on a server with Ubuntu 14.04.1, and our aim is to try Suricata in inline IPS mode.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">On our server we have a management interface (p1p1), and two interfaces linked to IXIA Breaking Point (IN: p4p1, OUT: p4p2), configured as follow (cat /etc/network/interfaces):<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"TIM Sans","serif"">auto lo<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"TIM Sans","serif"">iface lo inet loopback<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"TIM Sans","serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif""># The primary network interface<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">auto p1p1<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">iface p1p1 inet static<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">address XXX.XXX.XXX.XXX<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">netmask 255.255.255.0<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">network XXX.XXX.XXX.XXX<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">gateway XXX.XXX.XXX.XXX<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">dns-nameservers XXX.XXX.XXX.XXX XXX.XXX.XXX.XXX<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">dns-namesearch YYYYYYYYY<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif""># TRAFFIC_IN<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">auto p4p1<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">iface p4p1 inet manual<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif""> up ifconfig $IFACE 0.0.0.0 up<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif""> up ip link set $IFACE promisc on<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif""> post-up ethtool -K $IFACE gro off<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif""> post-up ethtool -K $IFACE lro off<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif""> down ip link set $IFACE promisc off<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif""> down ifconfig $IFACE down<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif""> mtu 1500<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif""># TRAFFIC_OUT<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">auto p4p2<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">iface p4p2 inet manual<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif""> up ifconfig $IFACE 0.0.0.0 up<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif""> up ip link set $IFACE promisc on<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif""> post-up ethtool -K $IFACE gro off<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif""> post-up ethtool -K $IFACE lro off<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif""> down ip link set $IFACE promisc off<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif""> down ifconfig $IFACE down<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif""> mtu 1500<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">We tried both with standard ixgbe and PF_RING ZC's ixgbe Intel drivers, but apparently something is going wrong.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">In fact Suricata starts without errors, but the traffic doesn't reach the p4p2 interface.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"TIM Sans","serif"">$ sudo suricata -c /etc/suricata/suricata.yaml --pfring -v<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:21 - <Notice> - This is Suricata version 3.1 RELEASE<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:21 - <Info> - CPUs/cores online: 40<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:21 - <Info> - Found an MTU of 1500 for 'p4p1'<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:21 - <Info> - Found an MTU of 1500 for 'p4p2'<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:21 - <Info> - Loading rule file: /etc/suricata/rules/botcc.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:21 - <Info> - Loading rule file: /etc/suricata/rules/ciarmy.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:21 - <Info> - Loading rule file: /etc/suricata/rules/compromised.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:21 - <Info> - Loading rule file: /etc/suricata/rules/drop.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:21 - <Info> - Loading rule file: /etc/suricata/rules/dshield.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:21 - <Info> - Loading rule file: /etc/suricata/rules/emerging-attack_response.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:21 - <Info> - Loading rule file: /etc/suricata/rules/emerging-chat.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:21 - <Info> - Loading rule file: /etc/suricata/rules/emerging-current_events.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:22 - <Info> - Loading rule file: /etc/suricata/rules/emerging-dns.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:22 - <Info> - Loading rule file: /etc/suricata/rules/emerging-dos.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:22 - <Info> - Loading rule file: /etc/suricata/rules/emerging-exploit.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:22 - <Info> - Loading rule file: /etc/suricata/rules/emerging-ftp.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:22 - <Info> - Loading rule file: /etc/suricata/rules/emerging-imap.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:22 - <Info> - Loading rule file: /etc/suricata/rules/emerging-malware.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:22 - <Info> - Loading rule file: /etc/suricata/rules/emerging-misc.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:22 - <Info> - Loading rule file: /etc/suricata/rules/emerging-mobile_malware.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:22 - <Info> - Loading rule file: /etc/suricata/rules/emerging-netbios.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:22 - <Info> - Loading rule file: /etc/suricata/rules/emerging-p2p.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:22 - <Info> - Loading rule file: /etc/suricata/rules/emerging-policy.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:22 - <Info> - Loading rule file: /etc/suricata/rules/emerging-pop3.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:22 - <Info> - Loading rule file: /etc/suricata/rules/emerging-rpc.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:22 - <Info> - Loading rule file: /etc/suricata/rules/emerging-scada.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:22 - <Info> - Loading rule file: /etc/suricata/rules/emerging-scan.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:22 - <Info> - Loading rule file: /etc/suricata/rules/emerging-smtp.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:22 - <Info> - Loading rule file: /etc/suricata/rules/emerging-snmp.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:22 - <Info> - Loading rule file: /etc/suricata/rules/emerging-sql.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:22 - <Info> - Loading rule file: /etc/suricata/rules/emerging-telnet.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:22 - <Info> - Loading rule file: /etc/suricata/rules/emerging-tftp.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:22 - <Info> - Loading rule file: /etc/suricata/rules/emerging-trojan.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:23 - <Info> - Loading rule file: /etc/suricata/rules/emerging-user_agents.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:23 - <Info> - Loading rule file: /etc/suricata/rules/emerging-voip.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:23 - <Info> - Loading rule file: /etc/suricata/rules/emerging-web_client.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:24 - <Info> - Loading rule file: /etc/suricata/rules/emerging-web_server.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:24 - <Info> - Loading rule file: /etc/suricata/rules/emerging-worm.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:24 - <Info> - Loading rule file: /etc/suricata/rules/tor.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:24 - <Info> - Loading rule file: /etc/suricata/rules/http-events.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:24 - <Info> - Loading rule file: /etc/suricata/rules/smtp-events.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:24 - <Info> - Loading rule file: /etc/suricata/rules/tls-events.rules<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:24 - <Info> - 38 rule files processed. 12426 rules successfully loaded, 0 rules failed<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:24 - <Info> - 12434 signatures processed. 1215 are IP-only rules, 5005 are inspecting packet payload, 7829 inspect application layer, 0 are decoder event only<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:25 - <Info> - Threshold config parsed: 0 rule(s) found<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:25 - <Info> - fast output device (regular) initialized: fast.log<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:25 - <Info> - eve-log output device (regular) initialized: eve.json<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:25 - <Info> - stats output device (regular) initialized: stats.log<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:25 - <Info> - Using 2 live device(s).<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:25 - <Info> - Using flow cluster mode for PF_RING (iface p4p1)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:25 - <Info> - (RX#01-p4p1) Using PF_RING v.6.5.0, interface p4p1, cluster-id 99, single-pfring-thread<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:25 - <Info> - Using flow cluster mode for PF_RING (iface p4p2)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:25 - <Info> - (RX#01-p4p2) Using PF_RING v.6.5.0, interface p4p2, cluster-id 93, single-pfring-thread<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:25 - <Info> - RunModeIdsPfringAutoFp initialised<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:06:25 - <Notice> - all 42 packet processing threads, 4 management threads initialized, engine started.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">^C4/7/2016 -- 16:07:09 - <Notice> - Signal Received. Stopping engine.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:07:09 - <Info> - time elapsed 44.118s<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:07:09 - <Info> - (RX#01-p4p1) Kernel: Packets 18, dropped 0<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:07:09 - <Info> - (RX#01-p4p1) Packets 18, bytes 1080<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:07:09 - <Info> - (RX#01-p4p2) Kernel: Packets 0, dropped 0<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:07:09 - <Info> - (RX#01-p4p2) Packets 0, bytes 0<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:07:10 - <Info> - cleaning up signature grouping structure... complete<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:07:10 - <Notice> - Stats for 'p4p1': pkts: 18, drop: 0 (0.00%), invalid chksum: 0<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">4/7/2016 -- 16:07:10 - <Notice> - Stats for 'p4p2': pkts: 0, drop: 0 (-nan%), invalid chksum: 0<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">Please note that in the same testbed we are able to run Snort (+ PF_RING) with traffic going through p4p1 --> p4p2, so we suspect that there could be a problem with the integration
of Suricata with PF_RING, or with Suricata itself.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">Thanks in advance for any help you are kind enough to provide.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">Best Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"TIM Sans","serif"">Andrea<o:p></o:p></span></p>
</div>
</body>
</html>