Im trying to configure Suricata with af_packet IPS mode.
My scenario is :
Firewall → eth1 - Suricatat - eth2 → LAN
As mentioned in Suricata documentation for af_packet ips mode no need to confire iptables only need to make both interface “UP”, thats it.
So i didn’t add any IP on both the interfaces, Just connected Wan cable to eth1 and LAN cable to eth2 . Both interface shows “UP” status but no IP.
I did tcpdump on both the interfaces and got expected packets.
And just to confirm, if you removed the Suricata from this setup and plugged the LAN straight into the firewall, the network is configured such that it works?
Hi,
Its a stupid mistake from my side, the second interface which i connected is on a wrong port. Now i am able to filter packets. Thanks.
One more question, @ish / @Jeff_Lucovsky By default for RHEL suricata package doesnt support ebpf , so i compiled one with required support,
This is Suricata version 6.0.4 RELEASE
Features: UNITTESTS PCAP_SET_BUFF AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT HAVE_NSS HTTP2_DECOMPRESSION HAVE_LUA HAVE_LIBJANSSON TLS TLS_C11 MAGIC RUST
SIMD support: SSE_4_2 SSE_4_1 SSE_3
Atomic intrinsics: 1 2 4 8 16 byte(s)
64-bits, Little-endian architecture
GCC version 8.5.0 20210514 (Red Hat 8.5.0-4), C version 201112
compiled with _FORTIFY_SOURCE=0
L1 cache line size (CLS)=64
thread local storage method: _Thread_local
compiled with LibHTP v0.5.39, linked against LibHTP v0.5.39
Suricata Configuration:
AF_PACKET support: yes
eBPF support: yes
XDP support: yes
PF_RING support: no
NFQueue support: no
NFLOG support: no
IPFW support: no
Netmap support: no
DAG enabled: no
Napatech enabled: no
WinDivert enabled: no
Unix socket enabled: yes
Detection enabled: yes
Libmagic support: yes
libnss support: yes
libnspr support: yes
libjansson support: yes
hiredis support: yes
hiredis async with libevent: no
Prelude support: no
PCRE jit: yes
LUA support: yes
libluajit: no
GeoIP2 support: yes
Non-bundled htp: no
Hyperscan support: yes
Libnet support: yes
liblz4 support: yes
HTTP2 decompression: yes
Rust support: yes
Rust strict mode: no
Rust compiler path: /usr/bin/rustc
Rust compiler version: rustc 1.54.0 (Red Hat 1.54.0-3.module+el8.5.0+712+d335422a)
Cargo path: /usr/bin/cargo
Cargo version: cargo 1.54.0
Cargo vendor: yes
Python support: yes
Python path: /usr/bin/python3
Python distutils yes
Python yaml yes
Install suricatactl: yes
Install suricatasc: yes
Install suricata-update: yes
Profiling enabled: no
Profiling locks enabled: no
Plugin support (experimental): yes
Development settings:
Coccinelle / spatch: no
Unit tests enabled: yes
Debug output enabled: no
Debug validation enabled: no
Generic build parameters:
Installation prefix: /usr
Configuration directory: /etc/suricata/
Log directory: /var/log/suricata/
--prefix /usr
--sysconfdir /etc
--localstatedir /var
--datarootdir /usr/share
Host: x86_64-pc-linux-gnu
Compiler: gcc (exec name) / g++ (real)
GCC Protect enabled: no
GCC march native enabled: yes
GCC Profile enabled: no
Position Independent Executable enabled: no
CFLAGS -g -O2 -std=c11 -march=native -I${srcdir}/../rust/gen -I${srcdir}/../rust/dist
PCAP_CFLAGS
SECCFLAGS
I have a list of IP’s (~5K) which need to drop before processing it.
How do i do that ?
How do i filter it using eBpf ?
My updated af-packet configuration is,
af-packet:
- interface: enp5s0f0
threads: 2
# Default clusterid. AF_PACKET will load balance packets based on flow.
cluster-id: 99
cluster-type: cluster_flow
defrag: yes
use-mmap: yes
mmap-locked: yes
#tpacket-v3: yes
ring-size: 5120
#block-size: 32768
#block-timeout: 10
#use-emergency-flush: yes
buffer-size: 32768
# disable-promisc: no
#checksum-checks: kernel
#bpf-filter: port 80 or udp
ebpf-filter-file: /var/lib/suricata/bypass_filter.bpf
copy-mode: ips
copy-iface: enp5s0f3