I’m running Suricata 6.x in IPS mode with nfqueue and noticing weird latency and timeouts. Has anyone else experienced this?
I’m using these iptables rules:
iptables -A INPUT -j NFQUEUE --queue-num 0 --queue-bypass iptables -A OUTPUT -j NFQUEUE --queue-num 0 --queue-bypass
and this config for nfq:
nfq: mode: accept batchcount: 20 fail-open: yes
SSH connections to the server are occasionally becoming unresponsive for about 20-60 seconds, and other connections to the server are doing the same (freezing for 20-60 seconds, before finally resolving, or sometimes just timing out). I’d say it’s roughly 2% of the time, but it’s hard to judge. When I shut down suricata and remove the nfqueue rules the issue goes away.
Memory and CPU seem fine, and the traffic to the server is very low.
There are no alerts at all in the logs related to these connections, only alerts from other IP addresses and other issues (botnets looking for VOIP vulnerabilities, etc).