<html><head></head><body><div>We use four 1Gbps interfaces in af_packet mode (2 pairs) all the time with one instance of Suricata and everything works fine. The appliances we use has a single i7 processor and 8 gb of memory. The appliances we purchase have 6 interfaces but we have not tried 3 pairs because we reserve the 6th port for management/log collection.</div><div><br></div><div>We have been using af_packet mode from day one of using Suricata. (From what I remember, 3 to 4 years maybe 5. Basically, since af_packet has been available.) We have always used Ubuntu server.<br></div><div><br></div><div>These interfaces have bypass built in for power failure and with extra software installed can bypass for o/s failure.</div><div><br></div><div>Like I said before, have never had any problems except in the earlier days for us and used Atom processors. They worked great except when bandwidth increased. That is when we went to i7's.<br></div><div><br></div><div>And we have not tried 4.1 yet. Hopefully soon in test mode.<br></div><br><font size="2" face="Arial">Leonard Jacobs</font><font size="2"><br></font><br><br><div><strong>
From:
</strong>
Kevin Branch <kevin@branchnetconsulting.com>
<br>
<strong>
To:
</strong>
<jordon.carpenter@rooksecurity.com>
<br>
<strong>
Cc:
</strong>
<oisf-users@lists.openinfosecfoundation.org>
<br>
<strong>
Sent:
</strong>
11/20/2018 4:30 PM
<br>
<strong>
Subject:
</strong>
Re: [Oisf-users] Suricata Multiple Interfaces
<br><br><blockquote class="mori" style="margin:0 0 0 .8ex;border-left:1px solid #CCC;padding-left:1ex;"><div>I've used Suricata on 5 interfaces at once with good results, actually a separate instance per interface and multiple threads per instance, but all on the same physical box. I don't think the main limit is interface count but raw traffic volume to be processed. If you have<div>enough memory and cores to spread around, and your rule set is trimmed down well and your BPF filters are tuning out waste noise, you can do quite a bit of Suricata monitoring on a single box. Keep an eye on packet loss at the kernel and PF_RING levels, as well as CPU and memory utilization levels.</div><div><br></div><div>Kevin</div></div><br><div class="mcntgmail_quote"><div>On Tue, Nov 20, 2018 at 5:22 PM Jordon Carpenter <<a href="mailto:jordon.carpenter@rooksecurity.com" title="Send email to jordon.carpenter@rooksecurity.com" class="mailto" target="_blank">jordon.carpenter@rooksecurity.com</a>> wrote:<br></div><blockquote class="mcntgmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div id="mcntm_-5119053135836859181bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px;margin:0px;line-height:auto">Is there a limit on the amount of interfaces Suricata can Monitor? I have done two and have been successful, but needing to bump it up to 3. Currently using pf_ring and Suricata 4.1. </div><br><div id="mcntm_-5119053135836859181bloop_sign_1542752396326620928" class="mcntm_-5119053135836859181bloop_sign"><span style="color:rgb(34,34,34);font-variant-ligatures:normal;font-size:14px;font-family:roboto,sans-serif"><strong><span style="color:rgb(0,0,0)">Thanks,<br>Jordon Carpenter</span></strong></span><br style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;font-variant-ligatures:normal"><span style="font-variant-ligatures:normal;font-size:12px;font-family:roboto,sans-serif"><a href="https://www.rooksecurity.com/" style="color:rgb(0,0,0)" target="_blank">Rook Security</a></span><br style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;font-variant-ligatures:normal"><span style="color:rgb(34,34,34);font-variant-ligatures:normal;font-size:12px;font-family:roboto,sans-serif"><em><span style="color:rgb(0,0,0)">Anticipate, Manage, & Eliminate Threats</span></em></span><br style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;font-variant-ligatures:normal"><br style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;font-variant-ligatures:normal"><span style="font-variant-ligatures:normal;font-size:12px;font-family:roboto,sans-serif">O: <a href="tel:(888)%20712-9531" style="color:rgb(17,85,204)" target="_blank">888.712.9531 x734</a></span><br style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;font-variant-ligatures:normal"><span style="font-variant-ligatures:normal;font-size:12px;font-family:calibri,sans-serif"><span style="font-family:roboto,sans-serif">E: <a href="mailto:jordon.carpenter@rooksecurity.com" style="color:rgb(17,85,204)" target="_blank" title="Send email to jordon.carpenter@rooksecurity.com" class="mailto">jordon.carpenter@rooksecurity.com</a><br><br></span><span style="font-family:roboto,sans-serif"><a href="https://www.facebook.com/rookteam" style="color:rgb(17,85,204)" target="_blank"><img alt="rookteam" class="mcntm_-5119053135836859181CToWUd" src="https://d23fetfglg1ija.cloudfront.net/signature_fields/56feae2eecca0b0003125675/A-FB.png" title="This image cannot be displayed." data-err-title="true" border="0"></a> <a href="https://twitter.com/rooksecurity" style="color:rgb(17,85,204)" target="_blank"><img alt="rooksecurity" class="mcntm_-5119053135836859181CToWUd" src="https://d23fetfglg1ija.cloudfront.net/signature_fields/56feae2eecca0b0003125675/A-TW.png" title="This image cannot be displayed." data-err-title="true" border="0"></a> <a href="https://www.linkedin.com/company/rook-security" style="color:rgb(17,85,204)" target="_blank"><img alt="Rook LinkedIn" class="mcntm_-5119053135836859181CToWUd" src="https://d23fetfglg1ija.cloudfront.net/signature_fields/56feae2eecca0b0003125675/A-LI.png" title="This image cannot be displayed." data-err-title="true" border="0"></a></span><br><br><br><span style="font-size:10px"><span style="font-family:roboto,sans-serif">This e-mail may contain confidential and privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive for the recipient), please contact the sender by reply e-mail and delete all copies of this message.</span></span></span></div></div>
_______________________________________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank" title="Send email to oisf-users@openinfosecfoundation.org" class="mailto">oisf-users@openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
<br>
Conference: <a href="https://suricon.net" target="_blank">https://suricon.net</a><br>
Trainings: <a href="https://suricata-ids.org/training/" target="_blank">https://suricata-ids.org/training/</a></blockquote></div>
<br><br>_______________________________________________<br>Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br><br>Conference: https://suricon.net<br>Trainings: https://suricata-ids.org/training/</blockquote></div><BR />
<BR />
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to which they
are addressed. If you have received this email in error please notify Netsecuris management at mgmt@netsecuris.com. Please note that any views or opinions presented in
this email are solely those of the author and do not necessarily
represent those of Netsecuris Inc. The integrity and
security of this message cannot be guaranteed on the Internet
<BR />
</body></html>