<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 3.0cm 70.85pt 3.0cm;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="ES" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US">UHmm, thanks for the info Özkan … I have done a simple test: I have installed a FreeBSD 12 guest under RHEL’s KVM host configuring e1000 as a virtual nic. I have compiled Suricata from source with netmap’s support and
it works out-of-the-box …<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">If I can, I will do some tests this week with Bro-IDS with netmap support and I will see how it goes …<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US" style="color:black">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:black">C. L. Martinez</span><span style="color:black"></span><span style="color:black">
</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">Özkan KIRIK <ozkan.kirik@gmail.com><br>
<b>Date: </b>Tuesday, 22 January 2019 at 18:27<br>
<b>To: </b>Carlos Lopez <clopmz@outlook.com><br>
<b>Cc: </b>oisf users <oisf-users@openinfosecfoundation.org><br>
<b>Subject: </b>Re: [Oisf-users] Strange issue with Suricata 4.1.2 under FreeBSD 12<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">Hello, <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I have same issue with FreeBSD 12.0 RELEASE-p2.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">I tried to use both ixl and igb NICs.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">When I put netmap with ips mode, capture.kernel_drops is same with capture.kernel_packets.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">22/1/2019 -- 08:58:40 - <Perf> - (W#01-igb3) Kernel: Packets 53, dropped 53, bytes<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">22/1/2019 -- 08:58:40 - <Perf> - (W#02-igb3) Kernel: Packets 0, dropped 0, bytes 0<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">22/1/2019 -- 08:58:40 - <Perf> - (W#03-igb3) Kernel: Packets 0, dropped 0, bytes 0<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">22/1/2019 -- 08:58:40 - <Perf> - (W#04-igb3) Kernel: Packets 0, dropped 0, bytes 0<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">22/1/2019 -- 08:58:40 - <Perf> - (W#05-igb3) Kernel: Packets 0, dropped 0, bytes 0<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">22/1/2019 -- 08:58:40 - <Perf> - (W#06-igb3) Kernel: Packets 0, dropped 0, bytes 0<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">22/1/2019 -- 08:58:40 - <Perf> - (W#07-igb3) Kernel: Packets 0, dropped 0, bytes 0<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">22/1/2019 -- 08:58:40 - <Perf> - (W#08-igb3) Kernel: Packets 0, dropped 0, bytes 0<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">22/1/2019 -- 08:58:40 - <Perf> - (W#01-igb3+) Kernel: Packets 0, dropped 0, bytes 0<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">22/1/2019 -- 08:58:41 - <Info> - Alerts: 0<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">22/1/2019 -- 08:58:41 - <Perf> - ippair memory usage: 382144 bytes, maximum: 167772<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">22/1/2019 -- 08:58:42 - <Perf> - host memory usage: 36614400 bytes, maximum: 134217<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">22/1/2019 -- 08:58:42 - <Info> - cleaning up signature grouping structure... comple<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">22/1/2019 -- 08:58:42 - <Notice> - Stats for 'igb3': pkts: 53, drop: 53 (100.00%),<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">22/1/2019 -- 08:58:42 - <Perf> - igb3: restoring tso offloading<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">22/1/2019 -- 08:58:42 - <Perf> - igb3: restoring lro offloading<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">22/1/2019 -- 08:58:42 - <Notice> - Stats for 'igb3+': pkts: 0, drop: 0 (nan%), inv<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">22/1/2019 -- 08:58:42 - <Perf> - Cleaning up Hyperscan global scratch<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">22/1/2019 -- 08:58:42 - <Perf> - Clearing Hyperscan database cache<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I think problem is same<o:p></o:p></p>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Tue, Jan 22, 2019 at 7:05 PM Carlos Lopez <<a href="mailto:clopmz@outlook.com">clopmz@outlook.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<p class="MsoNormal">More info about this, changing packet capture from netmap to pcap, all works ok. In theory, my ixgbe driver is supported for netmap:<br>
<br>
[1] 000.000024 [4184] netmap_init netmap: loaded module<br>
[1] ix0: netmap queues/slots: TX 8/2048, RX 8/2048<br>
[1] ix1: netmap queues/slots: TX 8/2048, RX 8/2048<br>
[1] ix2: netmap queues/slots: TX 8/2048, RX 8/2048<br>
[1] ix3: netmap queues/slots: TX 8/2048, RX 8/2048<br>
<br>
Any idea?<br>
<br>
Regards,<br>
C. L. Martinez<br>
<br>
<br>
________________________________________<br>
From: Oisf-users <<a href="mailto:oisf-users-bounces@lists.openinfosecfoundation.org" target="_blank">oisf-users-bounces@lists.openinfosecfoundation.org</a>> on behalf of Carlos Lopez <<a href="mailto:clopmz@outlook.com" target="_blank">clopmz@outlook.com</a>><br>
Sent: 21 January 2019 14:37<br>
To: oisf users<br>
Subject: [Oisf-users] Strange issue with Suricata 4.1.2 under FreeBSD 12<br>
<br>
Hi all,<br>
<br>
I have a strange issue with Suricata 4.1.2 under FreeBSD: suricata doesn't see traffic. Traffic is vlan's tagged. Using tcpdump with the options "-ttt -env -i ix1", I can see the traffic without problems.<br>
<br>
The option of net.bpf.zerocopy_enable=0 and I'm using netmap. Any idea why I can't see the traffic? I am completely lost..<br>
<br>
<br>
<br>
Regards,<br>
C. L. Martinez<br>
_______________________________________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">
oisf-users@openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support:
<a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">
https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
<br>
Conference: <a href="https://suricon.net" target="_blank">https://suricon.net</a><br>
Trainings: <a href="https://suricata-ids.org/training/" target="_blank">https://suricata-ids.org/training/</a><br>
_______________________________________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">
oisf-users@openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support:
<a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">
https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
<br>
Conference: <a href="https://suricon.net" target="_blank">https://suricon.net</a><br>
Trainings: <a href="https://suricata-ids.org/training/" target="_blank">https://suricata-ids.org/training/</a><o:p></o:p></p>
</blockquote>
</div>
</div>
</body>
</html>