[Oisf-users] Installing / Running Suricata with Myricom NICs

[Alexander Merck]

Hello,

Hopefully someone can help shed some light on some issues we've been seeing. We just installed a new instance of Suricata on a fresh RHEL7 monitoring box with Myricom cards. However, we are seeing significant packet loss (20-35%) on 2-3 Gbps traffic when attempting to use the SNF drivers.


I'm suspecting that the Myricom SNF drivers are not functioning as expected. We're able to run tcpdump compiled against these drivers with no issue, including generating debug output. We've also found when supplying the SNF_DEBUG_MASK environment variable when running Suricata, no debug output is generated.

Also, when using Suricata with the SNF drivers, should you be able to use the interface names specified by SNF (e.g. snf0)? When trying to run Suricata using the -i snf0, we get an "Unable to find iface snf0: No such device" error message. We are only able to run Suricata against the interface names specified by the kernel (in our case, enp4s0)


The version of Suricata is 4.0.4 and the version of SNF is 3.0.12. Running ldd shows that Suricata is linked against the SNF libraries.

# ldd /usr/bin/suricata
...
        libpcap.so.1 => /opt/snf/lib/libpcap.so.1 (0x00007f238ffb0000)
...
        libsnf.so.0 => /opt/snf/lib/libsnf.so.0 (0x00007f238dae4000)


We compiled Suricata per these instructions: https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Myricom. I did notice that this document is over five years old, but all of the configuration options seemed correct.

./configure --with-libpcap-includes=/opt/snf/include/ --with-libpcap-libraries=/opt/snf/lib/ --prefix=/usr --sysconfdir=/etc --localstatedir=/var

And we're running Suricata with the following command:

SNF_NUM_RINGS=32 SNF_DATARING_SIZE=17179869184 SNF_DESCRING_SIZE=4294967296 SNF_FLAGS=0x1 SNF_DEBUG_MASK=3 SNF_DEBUG_FILENAME="/tmp/snf.out" /usr/bin/suricata -c /etc/suricata/suricata.yaml -i enp4s0 --runmode=workers

The box we’re running this on has 64 cores and 256GB of RAM, so I doubt it’s a resource issue…but could potentially be a configuration issue.


Are we missing something in the install process that may be causing these issues? Any recommendations or pointers would be greatly appreciated. Thanks!

-Alex M


--
Alexander Merck
Duke University
IT Security Office
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20180220/7042ce1e/attachment.html>