<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p style="margin-top:0;margin-bottom:0"></p>
<div>Hi all,</div>
<div><br>
</div>
<div>Recently I installed a Myricom 10G with the Sniffer v3 software in a server to be </div>
<div>used for Suricata and I am having some issues with Suricata using the sniffer </div>
<div>interface.</div>
<div><br>
</div>
<div>I compiled a version of tcpdump with the /opt/snf libraries and it works fine with </div>
<div>both interfaces p1p1 and snf0.</div>
<div><br>
</div>
<div>$ ldd tcpdump | grep snf</div>
<div><span style="white-space:pre"></span>libpcap.so.1 => /opt/snf/lib/libpcap.so.1 (0x00007f6f6dbd8000)</div>
<div><span style="white-space:pre"></span>libsnf.so.0 => /opt/snf/lib/libsnf.so.0 (0x00007f6f6d5f7000)</div>
<div><br>
</div>
<div># SNF_NUM_RINGS=16 SNF_DEBUG_MASK=3 SNF_DATARING_SIZE=4294967296 SNF_DESCRING_SIZE=1073741824 /opt/tcpdump/tcpdump-4.1.1/tcpdump -n -i p1p1 -c 102400</div>
<div>15715 snf.0.-1 P (userset) SNF_PORTNUM = 0 </div>
<div>15715 snf.0.-1 P (default) SNF_RING_ID = -1 (0xffffffff) </div>
<div>15715 snf.0.-1 P (environ) SNF_NUM_RINGS = 16 (0x10) </div>
<div>15715 snf.0.-1 P (default) SNF_RSS_FLAGS = 49 (0x31) </div>
<div>15715 snf.0.-1 P (environ) SNF_DATARING_SIZE = 4294967296 (0x100000000) (4096.0 MiB) </div>
<div>15715 snf.0.-1 P (environ) SNF_DESCRING_SIZE = 1073741824 (0x40000000) (1024.0 MiB) </div>
<div>15715 snf.0.-1 P (userset) SNF_FLAGS = 1 (0x1) </div>
<div>15715 snf.0.-1 P (environ) SNF_DEBUG_MASK = 3 (0x3) </div>
<div>15715 snf.0.-1 P (default) SNF_DEBUG_FILENAME = stderr </div>
<div>15715 snf.0.-1 P (default) SNF_APP_ID = -1 (0xffffffff) </div>
<div>15715 snf.0.-1 P SNF_DEBUG_MASK=0x3 for modes WARN=0x1, PARAM=0x2 QSTATS=0x4 TIMESYNC=0x8 IOCTL=0x10 QEVENTS=0x20 ARISTA=0x40 </div>
<div>......</div>
<div>......</div>
<div>......</div>
<div>102400 packets captured</div>
<div>102400 packets received by filter</div>
<div>0 packets dropped by kernel</div>
<div>15726 snf.0.0 P rx_fini: tot= 4954776 [keep/skip/drop] [ 102400/4852376/ 0] [ 2.1%/ 97.9%/ 0.0%]</div>
<div>#</div>
<div><br>
</div>
<div>When you look at myri_counters it clearly shows that it is user the sniffer interface.</div>
<div><br>
</div>
<div> SNF recv pkts: 3974744</div>
<div> SNF drop ring full: 0</div>
<div><br>
</div>
<div>However with Suricata I cannot utilize the sniffer interface.</div>
<div><br>
</div>
<div>I tried the following configure options for suricata..</div>
<div><br>
</div>
<div># ./configure --prefix=/opt/suricata --sysconfdir=/opt/suricata/etc --localstatedir=/opt/suricata --enable-geopip -enable-lua --with-libpcap=/opt/snf/</div>
<div><br>
</div>
<div># ./configure --prefix=/opt/suricata --sysconfdir=/opt/suricata/etc --localstatedir=/opt/suricata --enable-geopip -enable-lua --with-libpcap-includes=/opt/snf/include/ --with-libpcap-libraries=/opt/snf/lib/</div>
<div><br>
</div>
<div># ./configure --prefix=/opt/suricata --sysconfdir=/opt/suricata/etc --localstatedir=/opt/suricata --enable-geopip -enable-lua --with-libpcap=/opt/snf/ --with-libpcap-includes=/opt/snf/include/ --with-libpcap-libraries=/opt/snf/lib/</div>
<div><br>
</div>
<div>The compiled version of suricata shows that it is linked with the snf.</div>
<div><br>
</div>
<div>$ ldd suricata | grep snf</div>
<div><span style="white-space:pre"></span>libpcap.so.1 => /opt/snf/lib/libpcap.so.1 (0x00007fb840a04000)</div>
<div><span style="white-space:pre"></span>libsnf.so.0 => /opt/snf/lib/libsnf.so.0 (0x00007fb83e528000)</div>
<div><br>
</div>
<div><br>
</div>
<div>I edited the pcap entry in suricata.yaml</div>
<div><br>
</div>
<div>pcap:</div>
<div> - interface: p1p1</div>
<div> threads: 16</div>
<div> buffer-size: 2gb</div>
<div> promisc: no</div>
<div><br>
</div>
<div>I ran variations of this command..</div>
<div><br>
</div>
<div># SNF_NUM_RINGS=16 SNF_DEBUG_MASK=3 SNF_DATARING_SIZE=4294967296 SNF_DESCRING_SIZE=1073741824 /opt/suricata/bin/suricata -i p1p1 -c /opt/suricata/etc/suricata/suricata.yaml -v --runmode=workers</div>
<div><br>
</div>
<div>After running these you look at myri_counters it shows no packets using the sniffer interface.</div>
<div><br>
</div>
<div> SNF recv pkts: 0</div>
<div> SNF drop ring full: 0</div>
<div><br>
</div>
<div>If you try to run the tests using the snf0 interface, suricata dies.</div>
<div><br>
</div>
<div>Any thoughts? I have reviewed the documentation from Myricom and Suricata as well.</div>
<div><br>
</div>
<div>Thanks,</div>
<div><br>
</div>
<div>Craig Edgmand</div>
<div>Oklahoma State University</div>
<div><br>
</div>
<br>
<p></p>
</div>
</body>
</html>