[Oisf-users] Suricata, 10k rules, 10Gbit/sec and lots of RAM

Jason Holmes jholmes at psu.edu
Mon Jan 11 17:02:32 UTC 2016


Hi Peter,

I had used "detect:" instead of "detect-engine:" because that's the 
syntax that is in the suricata.yaml that's included in the 
dev-detect-v173 branch.

Per your suggestion, I tried:

detect-engine:
   profile: custom
   custom-values:
     toclient-groups: 1000
     toserver-groups: 1000

and it still crashed.  I ran it inside of gdb and got this:

Program received signal SIGSEGV, Segmentation fault.
__strcmp_sse42 () at ../sysdeps/x86_64/multiarch/strcmp-sse42.S:164
164		movdqu	(%rdi), %xmm1
(gdb) bt
#0  __strcmp_sse42 () at ../sysdeps/x86_64/multiarch/strcmp-sse42.S:164
#1  0x00000000005a84ce in SetupDelayedDetect (suri=0x7fffffffe2d0) at 
suricata.c:1944
#2  0x00000000005a9b0c in main (argc=6, argv=0x7fffffffe4d8) at 
suricata.c:2299


If I try:

detect:
   profile: custom
   custom-values:
     toclient-groups: 1000
     toserver-groups: 1000

I get:

Program received signal SIGSEGV, Segmentation fault.
0x000000000049da75 in DetectEngineCtxLoadConf (de_ctx=0x19e862e0) at 
detect-engine.c:1025
1025	            TAILQ_FOREACH(opt, &de_ctx_custom->head, next) {
(gdb) bt
#0  0x000000000049da75 in DetectEngineCtxLoadConf (de_ctx=0x19e862e0) at 
detect-engine.c:1025
#1  0x000000000049d42f in DetectEngineCtxInitReal (minimal=0, 
prefix=0x0) at detect-engine.c:784
#2  0x000000000049d4ff in DetectEngineCtxInit () at detect-engine.c:825
#3  0x00000000005a9cc0 in main (argc=6, argv=0x7fffffffe4d8) at 
suricata.c:2313

Thanks,

--
Jason Holmes

On 1/11/16 11:49 AM, Peter Manev wrote:
> On Mon, Jan 11, 2016 at 5:16 PM, Jason Holmes <jholmes at psu.edu> wrote:
>> Hi,
>>
>> I just wanted to give some feedback on the grouping code branch
>> (dev-detect-grouping-v173).  I was running 3.0rc3 with:
>>
>> detect-engine:
>>    - profile: custom
>>    - custom-values:
>>        toclient-src-groups: 200
>>        toclient-dst-groups: 200
>>        toclient-sp-groups: 200
>>        toclient-dp-groups: 300
>>        toserver-src-groups: 200
>>        toserver-dst-groups: 400
>>        toserver-sp-groups: 200
>>        toserver-dp-groups: 250
>>
>> I tested dev-detect-grouping-v173 with:
>>
>> detect:
>>    profile: custom
>>    custom-values:
>>      toclient-groups: 1000
>>      toserver-groups: 1000
>>
>> (Actually, I had to hardcode this into src/detect-engine.c because the above
>> syntax caused Suricata to crash when starting up.  I didn't dig into it
>> enough to figure out why.)
>
> I do not like that "hardcoding" part at all !
>
> Please not there can be a problem because of spelling and indention.
> Your config part should loo like this:
>
> detect-engine:
>    - profile: custom
>    - custom-values:
>        toclient-groups: 1000
>        toserver-groups: 1000
>
> not like this:
>
> detect:
>    profile: custom
>    custom-values:
>      toclient-groups: 1000
>      toserver-groups: 1000
>
>
>
> Can you please give it a try again and see if that was the problem?
>
> Thanks
>
>>
>> The impetus for trying this was that adding additional rules to 3.0rc3
>> caused packet loss to jump from <1% to ~25%.  The <1% on 3.0rc3 was using
>> around 20,000 rules.  The 25% on 3.0rc3 was using around 30,000 rules.
>>
>> My observations (using 30,000 rules):
>>
>> 1. Startup time is greatly reduced.  With the above settings,
>> dev-detect-v173 starts up in about 2.5 minutes.  3.0rc3 took about 5.5
>> minutes.
>>
>> 2. Performance is significantly improved.  Packet loss dropped from ~25%
>> with 3.0rc3 to <1% with dev-detect-v173.  I'm also able to push more traffic
>> through the box and maintain <1%.  It's hard to quantify exactly since this
>> is production traffic and it spikes and dips, but I'd say 25% more traffic
>> would be a conservative estimate in increased throughput.
>>
>> I haven't had any stability issues that I wasn't already seeing in 3.0rc3.
>> To me, the new grouping code branch seems like a fundamental improvement.
>>
>> Thanks,
>>
>> --
>> Jason Holmes
>>
>>
>> On 12/8/15 12:12 PM, Victor Julien wrote:
>>>
>>> On 04-12-15 18:03, Cooper F. Nelson wrote:
>>>>
>>>> We are running the grouping code branch as well, ~7gbit traffic
>>>> and sampling port 80 flows.  Using groups of 1000.
>>>>
>>>> Performance so far is very good, currently running 27,568 ETPRO
>>>> signatures.
>>>
>>>
>>> How does it compare to your normal performance? Are you seeing
>>> differences in memory use, drop rate, etc?
>>>
>>> Thanks,
>>> Victor
>>>
>>>
>>>> On 12/3/2015 4:56 PM, Michal Purzynski wrote:
>>>>>
>>>>> I kind of feel responsible here and should answer this question.
>>>>
>>>>
>>>>> The grouping code branch will make it to Suricata post 3.0. Give.
>>>>> The new release schedule, this should be quick.
>>>>
>>>>
>>>>> I'm testing it on production traffic, more than 20gbit, two
>>>>> sensors (peak, but frequent, long and crazy. Average is between 3
>>>>> to 6gbit/sec).
>>>>
>>>>
>>>>> In order to stress the code I run it with even more insane
>>>>> settings, like this
>>>>
>>>>
>>>>> detect-engine: - profile: custom - custom-values:
>>>>> toclient-src-groups: 2000 toclient-dst-groups: 2000
>>>>> toclient-sp-groups: 2000 toclient-dp-groups: 3000
>>>>> toserver-src-groups: 2000 toserver-dst-groups: 4000
>>>>> toserver-sp-groups: 2000 toserver-dp-groups: 2500 -
>>>>> sgh-mpm-context: full - inspection-recursion-limit: 3000 -
>>>>> rule-reload: true
>>>>
>>>>
>>>>> Note - do not try this at home. Or work. It kills kittens on 2.x
>>>>
>>>>
>>>>> And it just works on the new branch that's yet to be merged :)
>>>>
>>>>
>>>>> Note - I have over 16500 rules now.
>>>>
>>>>
>>>>
>>>> _______________________________________________ Suricata IDS Users
>>>> mailing list: oisf-users at openinfosecfoundation.org Site:
>>>> http://suricata-ids.org | Support:
>>>> http://suricata-ids.org/support/ List:
>>>> https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>>>>
>>>>
>>> Suricata User Conference November 4 & 5 in Barcelona:
>>> http://oisfevents.net
>>>>
>>>>
>>>
>>
>> _______________________________________________
>> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
>> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
>> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>> Suricata User Conference November 4 & 5 in Barcelona: http://oisfevents.net
>
>
>




More information about the Oisf-users mailing list