Does AF_Packet now support the IPS mode?

Help
1

I see on the features page (All features | Suricata), the following information:

Packet acquisition

  • High performance capture
    • AF_PACKET
      • experimental eBPF and XDP modes available
    • PF_RING
    • NETMAP
  • Standard capture
    • PCAP
    • NFLOG (netfilter integration)
  • IPS mode
    • Netfilter based on Linux (nfqueue)
      • fail open support
    • ipfw based on FreeBSD and NetBSD
    • AF_PACKET based on Linux
    • NETMAP
  • Capture cards and specialized devices
    • Endace
    • Napatech
    • Tilera

Does this mean that IPS is supported with the AF_Packet? What is the performance difference with AF_Packet and NFQueue?

2

I can’t comment on the performance differences, but they do work somewhat difference. AF_PACKET IPS works by copying the packets received on one interface to another, so its bridging the ethernet interfaces. So this may determine if AF_PACKET can be used for you or not.

3

Thank you @ish, this is perfect for an inline filter.

Does it still act like an IPS @ish or is the bridge still copying the content if it is told to drop it?

4

It can still act as an IPS. Just pay attention to the copy-mode in your af-packet section when setting up the interfaces for the bridge.