<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>Just a simple start script within FreeBSD. Basically suricata --netmap -vvv</p>
<p><br>
</p>
<p>There are no errors reported in the suricata.log or within messages. I am thinking it may be related to a specific netmap+suricata configuration or compilation issue because we have built a secondary suricata system with the same config using afpacket on
linux, pfring on linux, and ipfw on FreeBSD. The real issue is that we need the performance of netmap to get as close to wire speed as possible. We have also tested some "precompiled" suricata installs on things like OPNSense and PFSense since they are using
suricata+netmap and they don't seem to have the issue. </p>
<p><br>
</p>
<p>Otherwise, if anyone could recommend the best way to get near wire speed on Linux, we would be glad to go that route. We are just unfamiliar with Pfring and all the required configuration options to tune it properly.</p>
<p><br>
</p>
<p>Thanks</p>
<p>Brandon</p>
<br>
<div style="color: rgb(0, 0, 0);">
<div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Oisf-users <oisf-users-bounces@lists.openinfosecfoundation.org> on behalf of Andreas Herz <andi@geekosphere.org><br>
<b>Sent:</b> Tuesday, September 6, 2016 3:29 PM<br>
<b>To:</b> oisf-users@lists.openinfosecfoundation.org<br>
<b>Subject:</b> Re: [Oisf-users] Suricata+Netmap IPS stops passing packets after approx 10 seconds</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">On 03/09/16 at 18:30, Brandon Reeves wrote:<br>
> We have got suricata+netmap working in IPS mode. Once we bring it up,<br>
> we can ping through the device as if it wasnt there. However, within a<br>
> few seconds of receiving traffic, all packets stop passing across<br>
> suricata. This means that all traffic outbound + inbound also stop.<br>
> All we have to do is restart suricata and the issue repeats. We have<br>
> tried multiple versions of FreeBSD as well as suricata and the same<br>
> issue appears. We have done little to tune the default suricata.yaml<br>
> since we have been combating this issue other than configuring the<br>
> interfaces. We have also used the default suricata.yaml from 3.0 and<br>
> 3.1.1.<br>
><br>
> [...]<br>
> <br>
> Please advise on how I can troubleshoot this issue<br>
<br>
How do you run suricata?<br>
Do you see any related messages from the system within the logs?<br>
<br>
We're getting more and more FreeBSD users, so I hope someone familiar<br>
with FreeBSD and suricata might step in.<br>
<br>
-- <br>
Andreas Herz<br>
_______________________________________________<br>
Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>
Site: <a href="http://suricata-ids.org" id="LPlnk838176">http://suricata-ids.org</a> | Support:
<a href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">
https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
Suricata User Conference November 9-11 in Washington, DC: <a href="http://oisfevents.net">
http://oisfevents.net</a></div>
</span></font></div>
</div>
</body>
</html>