<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>We are attempting to get Suricata working inline with netmap transparently. Basically, we want the ability to drop a box between traffic and have it be an IPS. We have netmap built into the kernel (currently FreeBSD 10.3) and suricata installed. However
when we put the device inline, it doesnt appear that traffic is being passed between the interfaces to let the connections out.</p>
<p><br>
</p>
<p>Here is our netmap config:</p>
<p></p>
<div>netmap:</div>
<div> # To specify OS endpoint add plus sign at the end (e.g. "eth0+")</div>
<div> - interface: default</div>
<div> threads: auto</div>
<div> copy-mode: ips</div>
<div> disable-promisc: no # promiscuous mode</div>
<div> checksum-checks: auto</div>
<div><br>
</div>
<div> - interface: em4</div>
<div> copy-iface: em5</div>
<div><br>
</div>
<div> - interface: em5</div>
<div> copy-iface: em4</div>
<div><br>
</div>
Notes:
<p></p>
<p>Suricata starts fine (no errors)</p>
<p>Traffic does not pass from internal to external (em4=internal / em5=external)</p>
<p>Suricata does appear to catch traffic on the em4 (internal interface)</p>
<p><br>
</p>
<p>Config:</p>
<p>FreeBSD 10.3 (rebuilt kernel with netmap)</p>
<p>Suricata <span style="font-size: 12pt;">version 3.0 RELEASE</span></p>
<p><br>
</p>
<p>Can anyone provide guidance related to getting suricata setup inline with netmap transparently? We need to deploy these without disrupting networks etc, so we just want them to be in the path of the packets, not part of the route.</p>
<p><br>
</p>
<p>Thanks</p>
<p>Brandon</p>
<div id="Signature"></div>
</div>
</body>
</html>