[Oisf-users] suricata vlan log - onionsecurity is ok, selks ko
Peter Manev
petermanev at gmail.com
Fri Mar 6 12:12:05 UTC 2015
On Thu, Mar 5, 2015 at 11:21 PM, john nesh <john.nesh76 at gmail.com> wrote:
> Hi Peter,
>
> Sorry for my delay, I was too busy.
> Unfortunately I can't provide you a pcap file.
> Is there something else I can provide you?
>
> Josh
Would you be having the same problem if you switch to Suricata 2.0.7?
(SELKS is running 2.1beta3 - back up the configs :) )
>
> 2015-03-02 11:20 GMT+01:00 Peter Manev <petermanev at gmail.com>:
>>
>> On Mon, Mar 2, 2015 at 11:04 AM, john nesh <john.nesh76 at gmail.com> wrote:
>> > Hi Peter,
>> >
>> > suricata --dump-config |grep vlan
>> > vlan = (null)
>> > vlan.use-for-tracking = true
>> >
>> > after using suricata this way:
>> > suricata -c /etc/suricata/suricata.yaml -s
>> > /etc/suricata/rules/scirius.rules
>> > -r capture.pcap --runmode autofp
>> >
>> > I do normally use workers for runmode but for file pcap needs autofp.
>> >
>> > grep vlan /var/log/suricata/stats.log | tail -10
>> >
>> > decoder.vlan | AFPacketeth01 | 0
>> > decoder.vlan_qinq | AFPacketeth01 | 0
>> > decoder.vlan | AFPacketeth11 | 0
>> > decoder.vlan_qinq | AFPacketeth11 | 0
>> > decoder.vlan | AFPacketeth01 | 0
>> > decoder.vlan_qinq | AFPacketeth01 | 0
>> > decoder.vlan | AFPacketeth11 | 0
>> > decoder.vlan_qinq | AFPacketeth11 | 0
>> > decoder.vlan | ReceivePcapFile | 32519
>> > decoder.vlan_qinq | ReceivePcapFile | 0
>> >
>> > seems working for filemode.
>> >
>> > Thank you for your support
>>
>> Would it be possible for you to share privately a pcap where i would
>> be able to reproduce the issue (it might be suri 2.1beta3 related
>> only).
>>
>> Thank you
>>
>> >
>> > John
>> >
>> >
>> > 2015-03-01 16:30 GMT+01:00 Peter Manev <petermanev at gmail.com>:
>> >>
>> >> On Fri, Feb 27, 2015 at 3:40 PM, john nesh <john.nesh76 at gmail.com>
>> >> wrote:
>> >> > Seems not:
>> >> > grep vlan stats.log | tail -10
>> >> > decoder.vlan | AFPacketeth11 | 0
>> >> > decoder.vlan_qinq | AFPacketeth11 | 0
>> >> > decoder.vlan | AFPacketeth01 | 0
>> >> > decoder.vlan_qinq | AFPacketeth01 | 0
>> >> > decoder.vlan | AFPacketeth11 | 0
>> >> > decoder.vlan_qinq | AFPacketeth11 | 0
>> >> > decoder.vlan | AFPacketeth01 | 0
>> >> > decoder.vlan_qinq | AFPacketeth01 | 0
>> >> > decoder.vlan | AFPacketeth11 | 0
>> >> > decoder.vlan_qinq | AFPacketeth11 | 0
>> >> >
>> >>
>> >> interesting....Suricata does not see any vlans
>> >>
>> >> > and:
>> >> > suricata --dump-counters | grep vlan
>> >> > suricata: unrecognized option '--dump-counters'
>> >>
>> >> I wrote the command wrong, sorry:
>> >> suricata --dump-config |grep vlan
>> >>
>> >>
>> >> >
>> >> > in tcpdump I do see:
>> >> > 802.1q Virtual LAN, PRI:0, CFI: 0, ID: 503
>> >> > 802.1q Virtual LAN, PRI:0, CFI: 0, ID: 241
>> >>
>> >> If you run a pcap from the tcpdump through suricata (-r) - would you
>> >> see the vlan counters in stats.log increasing (and that reflected in
>> >> the eve.json)?
>> >> I tried to replicate your problem - unsuccessfully however.
>> >>
>> >> Thank you
>> >>
>> >> >
>> >> > I do see:
>> >> > ethtool -k eth1
>> >> > Features for eth1:
>> >> > rx-checksumming: off
>> >> > tx-checksumming: off
>> >> > tx-checksum-ipv4: off
>> >> > tx-checksum-unneeded: off [fixed]
>> >> > tx-checksum-ip-generic: off [fixed]
>> >> > tx-checksum-ipv6: off
>> >> > tx-checksum-fcoe-crc: off [fixed]
>> >> > tx-checksum-sctp: off [fixed]
>> >> > scatter-gather: off
>> >> > tx-scatter-gather: off
>> >> > tx-scatter-gather-fraglist: off [fixed]
>> >> > tcp-segmentation-offload: off
>> >> > tx-tcp-segmentation: off
>> >> > tx-tcp-ecn-segmentation: off
>> >> > tx-tcp6-segmentation: off
>> >> > udp-fragmentation-offload: off [fixed]
>> >> > generic-segmentation-offload: off
>> >> > generic-receive-offload: off
>> >> > large-receive-offload: off [fixed]
>> >> > rx-vlan-offload: off
>> >> > tx-vlan-offload: off
>> >> > ntuple-filters: off [fixed]
>> >> > receive-hashing: off [fixed]
>> >> > highdma: on
>> >> > rx-vlan-filter: off [fixed]
>> >> > vlan-challenged: off [fixed]
>> >> > tx-lockless: off [fixed]
>> >> > netns-local: off [fixed]
>> >> > tx-gso-robust: off [fixed]
>> >> > tx-fcoe-segmentation: off [fixed]
>> >> > fcoe-mtu: off [fixed]
>> >> > tx-nocache-copy: on
>> >> > loopback: off [fixed]
>> >> >
>> >> > In suricata.yaml:
>> >> > vlan:
>> >> > use-for-tracking: true
>> >> >
>> >> >
>> >> > 2015-02-27 10:46 GMT+01:00 Peter Manev <petermanev at gmail.com>:
>> >> >>
>> >> >> On Fri, Feb 27, 2015 at 9:11 AM, john nesh <john.nesh76 at gmail.com>
>> >> >> wrote:
>> >> >> > Nope, I think that this is the issue.
>> >> >> > What could I share in order to get troubleshooting faster?
>> >> >>
>> >> >> Can you try to see(just to confirm) if there are any vlan counters
>> >> >> in
>> >> >> the stats.log (something like..)
>> >> >> grep vlan stats.log | tail -10
>> >> >>
>> >> >> Then could you do
>> >> >> suricata --dump-counters |grep vlan
>> >> >>
>> >> >>
>> >> >> Thanks
>> >> >>
>> >> >> >
>> >> >> > 2015-02-26 23:37 GMT+01:00 Peter Manev <petermanev at gmail.com>:
>> >> >> >>
>> >> >> >> On Thu, Feb 26, 2015 at 10:51 PM, john nesh
>> >> >> >> <john.nesh76 at gmail.com>
>> >> >> >> wrote:
>> >> >> >> > Seems not working also in this way.
>> >> >> >> > Is there anything else I could check?
>> >> >> >>
>> >> >> >> Do you have vlan IDs in eve.json ?
>> >> >> >>
>> >> >> >> >
>> >> >> >> > 2015-02-26 21:53 GMT+01:00 Peter Manev <petermanev at gmail.com>:
>> >> >> >> >>
>> >> >> >> >> On Thu, Feb 26, 2015 at 9:43 PM, john nesh
>> >> >> >> >> <john.nesh76 at gmail.com>
>> >> >> >> >> wrote:
>> >> >> >> >> > You are right,
>> >> >> >> >> >
>> >> >> >> >> > rx-vlan-offload: on
>> >> >> >> >> > tx-vlan-offload: on
>> >> >> >> >> >
>> >> >> >> >> > Do I have to disable it?
>> >> >> >> >>
>> >> >> >> >> Just run that -
>> >> >> >> >>
>> >> >> >> >>
>> >> >> >> >> /opt/selks/Scripts/Setup/reconfigure-listening-interface_stamus.sh
>> >> >> >> >>
>> >> >> >> >>
>> >> >> >> >>
>> >> >> >> >> >
>> >> >> >> >> > 2015-02-26 21:04 GMT+01:00 Peter Manev
>> >> >> >> >> > <petermanev at gmail.com>:
>> >> >> >> >> >>
>> >> >> >> >> >> On Thu, Feb 26, 2015 at 8:18 PM, john nesh
>> >> >> >> >> >> <john.nesh76 at gmail.com>
>> >> >> >> >> >> wrote:
>> >> >> >> >> >> > Hi,
>> >> >> >> >> >> >
>> >> >> >> >> >> > I am facing a different behaviour regarding vlans in
>> >> >> >> >> >> > logs.
>> >> >> >> >> >> > I made an installation of securityonion and vlan worked
>> >> >> >> >> >> > log
>> >> >> >> >> >> > in
>> >> >> >> >> >> > eve.json
>> >> >> >> >> >> > worked flawlessy but not in selks.
>> >> >> >> >> >> > I have read that vlan behaviour had changed in 2.1
>> >> >> >> >> >> >
>> >> >> >> >> >> > in my suricata.yaml I have:
>> >> >> >> >> >> >
>> >> >> >> >> >> > vlan:
>> >> >> >> >> >> > use-for-tracking: true
>> >> >> >> >> >> >
>> >> >> >> >> >> > But I have no log in eve.json.
>> >> >> >> >> >> > Is this an expected behaviour?
>> >> >> >> >> >>
>> >> >> >> >> >> You might have vlan offloading enabled on your NIC - if
>> >> >> >> >> >> that
>> >> >> >> >> >> is
>> >> >> >> >> >> the
>> >> >> >> >> >> case you would need to disable it.
>> >> >> >> >> >> (ethtool -k interface - will show the status)
>> >> >> >> >> >>
>> >> >> >> >> >> >
>> >> >> >> >> >> > John
>> >> >> >> >> >> >
>> >> >> >> >> >> > _______________________________________________
>> >> >> >> >> >> > Suricata IDS Users mailing list:
>> >> >> >> >> >> > oisf-users at openinfosecfoundation.org
>> >> >> >> >> >> > Site: http://suricata-ids.org | Support:
>> >> >> >> >> >> > http://suricata-ids.org/support/
>> >> >> >> >> >> > List:
>> >> >> >> >> >> >
>> >> >> >> >> >> >
>> >> >> >> >> >> >
>> >> >> >> >> >> >
>> >> >> >> >> >> > https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>> >> >> >> >> >> > Training now available: http://suricata-ids.org/training/
>> >> >> >> >> >>
>> >> >> >> >> >>
>> >> >> >> >> >>
>> >> >> >> >> >> --
>> >> >> >> >> >> Regards,
>> >> >> >> >> >> Peter Manev
>> >> >> >> >> >
>> >> >> >> >> >
>> >> >> >> >>
>> >> >> >> >>
>> >> >> >> >>
>> >> >> >> >> --
>> >> >> >> >> Regards,
>> >> >> >> >> Peter Manev
>> >> >> >> >
>> >> >> >> >
>> >> >> >>
>> >> >> >>
>> >> >> >>
>> >> >> >> --
>> >> >> >> Regards,
>> >> >> >> Peter Manev
>> >> >> >
>> >> >> >
>> >> >>
>> >> >>
>> >> >>
>> >> >> --
>> >> >> Regards,
>> >> >> Peter Manev
>> >> >
>> >> >
>> >>
>> >>
>> >>
>> >> --
>> >> Regards,
>> >> Peter Manev
>> >
>> >
>>
>>
>>
>> --
>> Regards,
>> Peter Manev
>
>
--
Regards,
Peter Manev
More information about the Oisf-users
mailing list