[Oisf-users] Suricata Multiple Interfaces

Tue Nov 20 22:35:10 UTC 2018

Thanks Kevin!

*Thanks,Jordon Carpenter*
Rook Security <https://www.rooksecurity.com/>
*Anticipate, Manage, & Eliminate Threats*

O: 888.712.9531 x734 <(888)%20712-9531>
E: jordon.carpenter at rooksecurity.com

[image: rookteam] <https://www.facebook.com/rookteam>    [image:
rooksecurity] <https://twitter.com/rooksecurity>    [image: Rook LinkedIn]
<https://www.linkedin.com/company/rook-security>

This e-mail may contain confidential and privileged material for the sole
use of the intended recipient. Any review, use, distribution or disclosure
by others is strictly prohibited. If you are not the intended recipient (or
authorized to receive for the recipient), please contact the sender by
reply e-mail and delete all copies of this message.

On November 20, 2018 at 5:31:13 PM, Kevin Branch (
kevin at branchnetconsulting.com) wrote:

I've used Suricata on 5 interfaces at once with good results, actually a
separate instance per interface and multiple threads per instance, but all
on the same physical box.  I don't think the main limit is interface count
but raw traffic volume to be processed.  If you have
enough memory and cores to spread around, and your rule set is trimmed down
well and your BPF filters are tuning out waste noise, you can do quite a
bit of Suricata monitoring on a single box.  Keep an eye on packet loss at
the kernel and PF_RING levels, as well as CPU and memory utilization levels.

Kevin

On Tue, Nov 20, 2018 at 5:22 PM Jordon Carpenter <
jordon.carpenter at rooksecurity.com> wrote:

> Is there a limit on the amount of interfaces Suricata can Monitor? I have
> done two and have been successful, but needing to bump it up to 3.
> Currently using pf_ring and Suricata 4.1.
>
>
> *Thanks, Jordon Carpenter*
> Rook Security <https://www.rooksecurity.com/>
> *Anticipate, Manage, & Eliminate Threats*
>
> O: 888.712.9531 x734 <(888)%20712-9531>
> E: jordon.carpenter at rooksecurity.com
>
> [image: rookteam]
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.facebook.com_rookteam&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=RqlGO2PqbPIrFb_si0uTHUdVyfofKl2-3khReemoyoPWr55BNmOEPXVxWZhEPxNS&m=uZXbrROjy-zGNNBU-f2wvMUEDJnGxAPLHw2eS0tXxOY&s=rUD7HXgj_yFzXwpR_ckCD2FwtCOJF4kYhu7dMrKV3jQ&e=>
>  [image: rooksecurity]
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_rooksecurity&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=RqlGO2PqbPIrFb_si0uTHUdVyfofKl2-3khReemoyoPWr55BNmOEPXVxWZhEPxNS&m=uZXbrROjy-zGNNBU-f2wvMUEDJnGxAPLHw2eS0tXxOY&s=1RP_ZRnYP0Q7BG-W_QYgMRcF4jOdWAK_IN0kwDAZ7WM&e=>
>  [image: Rook LinkedIn]
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.linkedin.com_company_rook-2Dsecurity&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=RqlGO2PqbPIrFb_si0uTHUdVyfofKl2-3khReemoyoPWr55BNmOEPXVxWZhEPxNS&m=uZXbrROjy-zGNNBU-f2wvMUEDJnGxAPLHw2eS0tXxOY&s=13uidg5kyboXY2ReLbD2lPqBCpE82rKm9vXOvuZ3n3I&e=>
>
>
> This e-mail may contain confidential and privileged material for the sole
> use of the intended recipient. Any review, use, distribution or disclosure
> by others is strictly prohibited. If you are not the intended recipient (or
> authorized to receive for the recipient), please contact the sender by
> reply e-mail and delete all copies of this message.
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site:
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__suricata-2Dids.org&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=RqlGO2PqbPIrFb_si0uTHUdVyfofKl2-3khReemoyoPWr55BNmOEPXVxWZhEPxNS&m=uZXbrROjy-zGNNBU-f2wvMUEDJnGxAPLHw2eS0tXxOY&s=Za_iiZMFbehx0BVkTTEHd4tMx8rtNIkKAcrCImW2dQk&e=>
> http://suricata-ids.org
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__suricata-2Dids.org&d=DwQFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=RqlGO2PqbPIrFb_si0uTHUdVyfofKl2-3khReemoyoPWr55BNmOEPXVxWZhEPxNS&m=uZXbrROjy-zGNNBU-f2wvMUEDJnGxAPLHw2eS0tXxOY&s=Za_iiZMFbehx0BVkTTEHd4tMx8rtNIkKAcrCImW2dQk&e=>
> | Support:
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__suricata-2Dids.org_support_&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=RqlGO2PqbPIrFb_si0uTHUdVyfofKl2-3khReemoyoPWr55BNmOEPXVxWZhEPxNS&m=uZXbrROjy-zGNNBU-f2wvMUEDJnGxAPLHw2eS0tXxOY&s=TL3pnZZ-mP0OH4_U3l6bCn1ue8rOp4ULCx8ZR-f1qis&e=>
> http://suricata-ids.org/support/
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__suricata-2Dids.org_support_&d=DwQFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=RqlGO2PqbPIrFb_si0uTHUdVyfofKl2-3khReemoyoPWr55BNmOEPXVxWZhEPxNS&m=uZXbrROjy-zGNNBU-f2wvMUEDJnGxAPLHw2eS0tXxOY&s=TL3pnZZ-mP0OH4_U3l6bCn1ue8rOp4ULCx8ZR-f1qis&e=>
> List:
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.openinfosecfoundation.org_mailman_listinfo_oisf-2Dusers&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=RqlGO2PqbPIrFb_si0uTHUdVyfofKl2-3khReemoyoPWr55BNmOEPXVxWZhEPxNS&m=uZXbrROjy-zGNNBU-f2wvMUEDJnGxAPLHw2eS0tXxOY&s=tmgv_f-9C0na1jWamaAdAAyv0VvDrlUsgzRoMTRqd1E&e=>
> https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.openinfosecfoundation.org_mailman_listinfo_oisf-2Dusers&d=DwQFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=RqlGO2PqbPIrFb_si0uTHUdVyfofKl2-3khReemoyoPWr55BNmOEPXVxWZhEPxNS&m=uZXbrROjy-zGNNBU-f2wvMUEDJnGxAPLHw2eS0tXxOY&s=tmgv_f-9C0na1jWamaAdAAyv0VvDrlUsgzRoMTRqd1E&e=>
>
> Conference:
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__suricon.net&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=RqlGO2PqbPIrFb_si0uTHUdVyfofKl2-3khReemoyoPWr55BNmOEPXVxWZhEPxNS&m=uZXbrROjy-zGNNBU-f2wvMUEDJnGxAPLHw2eS0tXxOY&s=PC77fsbLE9f_LaOyQiiHcXqspxTVvdP3rTXy-P21dwU&e=>
> https://suricon.net
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__suricon.net&d=DwQFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=RqlGO2PqbPIrFb_si0uTHUdVyfofKl2-3khReemoyoPWr55BNmOEPXVxWZhEPxNS&m=uZXbrROjy-zGNNBU-f2wvMUEDJnGxAPLHw2eS0tXxOY&s=PC77fsbLE9f_LaOyQiiHcXqspxTVvdP3rTXy-P21dwU&e=>
> Trainings:
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__suricata-2Dids.org_training_&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=RqlGO2PqbPIrFb_si0uTHUdVyfofKl2-3khReemoyoPWr55BNmOEPXVxWZhEPxNS&m=uZXbrROjy-zGNNBU-f2wvMUEDJnGxAPLHw2eS0tXxOY&s=9N7ewCdWeAmWpqevM1mL-Gl54nX5CpCosO22Ejj4q6o&e=>
> https://suricata-ids.org/training/
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__suricata-2Dids.org_training_&d=DwQFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=RqlGO2PqbPIrFb_si0uTHUdVyfofKl2-3khReemoyoPWr55BNmOEPXVxWZhEPxNS&m=uZXbrROjy-zGNNBU-f2wvMUEDJnGxAPLHw2eS0tXxOY&s=9N7ewCdWeAmWpqevM1mL-Gl54nX5CpCosO22Ejj4q6o&e=>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20181120/c89a1281/attachment-0001.html>