Asymmetric Traffic

Help
1

Hi,

I have traffic flow which is feed to Suricata.

Below is the traffic detail which is feed to Suricata in IPS mode via TAP interfaces,

  • In one direction, traffic is VxLAN encapsulated
  • In another direction, traffic is without VxLAN encapsulation

Will this cause issue for Suricata to detect/block traffic ?

Thanks

2

For Suricata to work in IPS mode, it has to be installed inline (not via tap) otherwise it will drop a copy of the packet and not the actual one.

Other things that comes to mind from the VLAN situation:

  • make sure use-for-tracking is set to false in suricata.yaml.
  • if you are using rss to distribute traffic to multiple queues in your NIC, make sure vlan header is ignored, or use a single queue.
3

Suricata will be running on AF-PACKET TAP interfaces (in and out) and physical interfaces will be connected to tap interfaces via bridge in IPS mode.

4

Oh, pardon me for misreading the question, however I think the two other points might be still valid.

5

So you’re talking about TAP interfaces and IPS mode with a bridge. Can you draw the setup and be more precise on what part Suricata would be running?
Depending on the details it could be an issue or not.