In my production environment, traffic mirroring is done by encapsulating data packets in VXLAN format and sending them out. Unfortunately, due to some reasons, the agent collecting traffic mirroring always sends data with the same source port, which prevents me from using the cluster_per_flow config…

Does Suricata support cross-packet reassembly with PF_RING cluster_round_robin?

shell_xu (shell xu) April 11, 2023, 9:21am 4

I Create new Topic.

Topic		Replies	Views
Feature request, requires Suricata support for innet 5 tuple mode Help suricata	2	391	April 25, 2023
Suricata Performance tuning Help	19	5750	November 24, 2020
Can Suricata reassemble a flow from different network interfaces? Help	5	1431	June 26, 2020
Suricata PF_RING in IPS mode Help	5	905	June 7, 2024
Traffic stream issue: packet/thread mismatch Help	2	677	January 21, 2022