In my production environment, traffic mirroring is done by encapsulating data packets in VXLAN format and sending them out. Unfortunately, due to some reasons, the agent collecting traffic mirroring always sends data with the same source port, which prevents me from using the cluster_per_flow config…

Does Suricata support cross-packet reassembly with PF_RING cluster_round_robin?

shell_xu (shell xu) April 11, 2023, 9:21am 4

I Create new Topic.

Topic		Replies	Views
Suricata Performance tuning Help	19	5117	November 24, 2020
Traffic stream issue: packet/thread mismatch Help	2	569	January 21, 2022
Asymmetric Traffic within Suricata Help	3	2981	February 4, 2021
Tcp.pkt_on_wrong_thread Help	19	2067	November 4, 2021
Suricata run only one cpu process packet Help	20	1516	December 1, 2020