<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div dir="ltr">You don’t need to use two Ethernet interfaces if your taps come into a pocket broker.</div><div dir="ltr"><br></div><div dir="ltr">Look at Arista TapAgg documentation </div><div dir="ltr"><br><blockquote type="cite">On Oct 30, 2019, at 9:50 AM, mohammad kashif <kashif.alig@gmail.com> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"><div dir="ltr">Hi Cooper<div><br></div><div>Sorry for not asking the question correctly. As I understand, Suricata needs both direction of flow in single instance to be able to analyse traffic. In our case, we are using two interfaces say eth1 and eth2 for traffic capture, so can I tell suricata to use both interface together and how ?</div><div><br></div><div>Thanks and regards</div><div><br></div><div>Kashif</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Oct 30, 2019 at 3:53 PM Nelson, Cooper <<a href="mailto:cnelson@ucsd.edu">cnelson@ucsd.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_3910812434545171194WordSection1">
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">You answered your own question:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">“</span>We are using Arista switch as packet broker and mirroring Rx and Tx as Rx on two separate NIC Ports on the server. “<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">You only see separate RX and TX on a server NIC that is sending packets outbound. On a tap/monitor port everything is over the RX ports.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">In fact, during my Bell Labs days I remember Steve Bellovin used to make special cables for their honeypots that had the TX line severed, so there was no possibility of an information leak or ‘fail open’ type scenario.
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">-Coop<span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif"> Oisf-users <<a href="mailto:oisf-users-bounces@lists.openinfosecfoundation.org" target="_blank">oisf-users-bounces@lists.openinfosecfoundation.org</a>>
<b>On Behalf Of </b>mohammad kashif<br>
<b>Sent:</b> Wednesday, October 30, 2019 5:14 AM<br>
<b>To:</b> <a href="mailto:oisf-users@lists.openinfosecfoundation.org" target="_blank">oisf-users@lists.openinfosecfoundation.org</a><br>
<b>Subject:</b> [Oisf-users] Suricata seperate Rx/Tx connection<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Hi<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I am exploring Suricata as IDS for our 10Gbps setup. We are using Arista switch as packet broker and mirroring Rx and Tx as Rx on two separate NIC Ports on the server. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">As suricata needs both side of flow to make sense of the traffic, what is the best way to present this two separate ports as one to suricata? <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Previously snort was running on the same setup and was using pfring and it was running with option <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">-i eth0,eth1 <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Is that something similar in suricata or I am missing something obvious?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Regards<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Kashif<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
</div>
</blockquote></div>
<span>_______________________________________________</span><br><span>Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org</span><br><span>Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/</span><br><span>List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</span><br><span></span><br><span>Conference: https://suricon.net</span><br><span>Trainings: https://suricata-ids.org/training/</span></div></blockquote></body></html>