[Oisf-users] Can I run Suricata with AF_Packet inside container

[Leonard Jacobs]

You need to disable GRO and LRO on your interfaces.  Use ethtool to disable.  Google search it.
 
From: Saxena, Samiksha [mailto:samiksha.saxena at verizon.com] 
Sent: Friday, June 19, 2015 12:57 PM
To: Leonard Jacobs; oisf-users at lists.openinfosecfoundation.org
Subject: Re: [Oisf-users] Can I run Suricata with AF_Packet inside container
 
Yes, I added the interface information in suricata.yaml.  This is what I am getting: 
 
root at blade6:/# suricata -c /etc/suricata/suricata.yaml --af-packet
19/6/2015 -- 15:07:45 - <Notice> - This is Suricata version 2.0.8 RELEASE
19/6/2015 -- 15:07:53 - <Notice> - all 38 packet processing threads, 3 management threads initialized, engine started.
19/6/2015 -- 15:07:53 - <Warning> - [ERRCODE: SC_ERR_AFP_CREATE(190)] - Using mmap mode with GRO or LRO activated can lead to capture problems
19/6/2015 -- 15:07:53 - <Warning> - [ERRCODE: SC_ERR_AFP_CREATE(190)] - Using mmap mode with GRO or LRO activated can lead to capture problems
^C19/6/2015 -- 15:08:27 - <Notice> - Signal Received.  Stopping engine.
19/6/2015 -- 15:08:27 - <Notice> - Stats for 'em1':  pkts: 1312, drop: 0 (0.00%), invalid chksum: 0
19/6/2015 -- 15:08:27 - <Notice> - Stats for 'vethd56c973':  pkts: 21, drop: 0 (0.00%), invalid chksum: 0
root at blade6:/# 
 
From: Leonard Jacobs <ljacobs at netsecuris.com>
Date: Friday, June 19, 2015 at 1:50 PM
To: "Saxena, Samiksha" <samiksha.saxena at one.verizon.com>, "oisf-users at lists.openinfosecfoundation.org" <oisf-users at lists.openinfosecfoundation.org>
Subject: RE: [Oisf-users] Can I run Suricata with AF_Packet inside container
 
Did you setup the interfaces within suricata.yaml in the af-packet section?  Set ips mode in that section?
 
See https://home.regit.org/2012/09/new-af_packet-ips-mode-in-suricata/.  It works.  We use and it works great as long as your rules are set to drop as the action.
 
From: oisf-users-bounces at lists.openinfosecfoundation.org [mailto:oisf-users-bounces at lists.openinfosecfoundation.org] On Behalf Of Saxena, Samiksha
Sent: Friday, June 19, 2015 12:48 PM
To: oisf-users at lists.openinfosecfoundation.org
Subject: [Oisf-users] Can I run Suricata with AF_Packet inside container
 
Hi,
 
I want to run Suricata with AF_packet mode inside a docker container. I am having trouble with configuring the interfaces. Also, I ran a simple rule of dropping every TCP request, but seems like nothing is dropped.
 
Thanks
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20150619/f26d79b4/attachment-0002.html>