<html><head></head><body>af-packet does its own bridging so you don't have to bridge at the interface level.<br><br><font size="4" face="Arial">Leonard</font><br><br><br><div><strong>
From:
</strong>
Albert Whale <Albert.Whale@IT-Security-inc.com>
<br>
<strong>
To:
</strong>
<oisf-users@lists.openinfosecfoundation.org>
<br>
<strong>
Sent:
</strong>
3/9/2018 1:58 PM
<br>
<strong>
Subject:
</strong>
[Oisf-users] Running Suricata in nfqueue mode - no events logged
<br><br><blockquote class="mori" style="margin:0 0 0 .8ex;border-left:1px solid #CCC;padding-left:1ex;">Ok, I have iptables confirmed and Configured. I have Suricata set up <br>for nfq and using queue 0.<br><br>In a matter of more than 10 minutes I have had 5 messages which were <br>logged to the fast.log file. In comparison, I have hundreds of entries <br>in 10 minutes logged while running Suricata in af-packet mode.<br><br>What makes Suricata ignore the packets in the NFQUEUE when running in <br>nfq mode?<br><br>My current nfq settings are:<br><br>nfq:<br> mode: accept<br> repeat-mark: 1<br> repeat-mask: 1<br> bypass-mark: 1<br> bypass-mask: 1<br> route-queue: 2<br># batchcount: 20<br> fail-open: yes<br><br>I want to run in IPS mode not IDS. Is there something that needs <br>changed when switching from af-packet mode to nfq that I haven't already <br>done? Do I need to switch my mode from accept to repeat?<br><br>I have a Bridged interface and I also have provisioned the IPTables on <br>the INPUT and OUTPUT sections to forward the packets to queue 0.<br><br>I have spent a day working with Chris from the list, and we have <br>reviewed and sanctioned the network and queue processing, I need <br>assistance with configuring Suricata to enable this. (Or, do I need to <br>compile a version on this system running Ubuntu 16.04?<br><br>Thank you all.<br><br>-- <br>--<br><br>Albert E. Whale, CEH CHS CISA CISSP<br>Email: Albert.Whale@IT-Security-inc.com<br><br>_______________________________________________<br>Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br><br>Conference: https://suricon.net<br>Trainings: https://suricata-ids.org/training/</blockquote></div><BR />
<BR />
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to which they
are addressed. If you have received this email in error please notify Netsecuris management at mgmt@netsecuris.com. Please note that any views or opinions presented in
this email are solely those of the author and do not necessarily
represent those of Netsecuris Inc. The integrity and
security of this message cannot be guaranteed on the Internet
<BR />
</body></html>