[Oisf-users] Netmap pipe configuration

[Eric Leblond]

Hi,

On Tue, 2017-01-31 at 15:52 -0800, James Dickenson wrote:
> Hey All,
> 
> I'm trying to test a Suricata configuration using Netmap and the
> bundled Netmap tool lb to load balance for the Suricata worker
> threads.  However I've run into some trouble trying to figure out how
> to get Suricata to bind to the netmap pipes.
> 
> Anyone have any experience with using Netmap with Suricata? Or for
> that matter used the lb to do load balancing?
> 
> Thanks in advance for the assistance!
> 
> -James
> 
> I can do the following:
> 
> # lb -i ens1f1 -p foo:4
> 
> and can bind to any of the four pipes using the netmap tool pkt-gen:
> 
> # pkt-gen -i foo}0 -f rx
> 
> But if I try on Suricata:
> 
> # /usr/bin/suricata  -c /etc/suricata/suricata.yaml --netmap=foo}0 
> --runmode=workers 

I'm not a netmap expert at all and I've never heard about this lb
tool. 
But my understanding of netmap is that it behaves like the other
capture method. So you specify the interface to attach to and then you
say in Suricata YAML configuration how much threads you want to have.

So in your case:

usr/bin/suricata  -c /etc/suricata/suricata.yaml --netmap=ensf1

and in the YAML:

 netmap:
     # To specify OS endpoint add plus sign at the end (e.g. "eth0+")
   - interface: ens1f1
     threads: 4

BR,
-- 
Eric Leblond <eric at regit.org>