# Enable eBPF and XDP mode in Suricata **URL:** \ **Category:** Help\ **Created:** [August 20, 2024, 7:27am UTC](https://forum.suricata.io/t/enable-ebpf-and-xdp-mode-in-suricata/4817 "2024-08-20T07:27:26Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![rayyanekaputra](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/rayyanekaputra/32/3078_2.png) [@rayyanekaputra](https://forum.suricata.io/u/rayyanekaputra)\ **Post date:** [August 20, 2024, 7:27am UTC](https://forum.suricata.io/t/enable-ebpf-and-xdp-mode-in-suricata/4817/1 "2024-08-20T07:27:26Z")
> Please include the following information with your help request: > > - Suricata version -\>7.0.6 > - Operating system and/or Linux distribution → Ubuntu 22 Server > - How you installed Suricata (from source, packages, something else) → apt here are the problems i encountered: 1. first i tried to enable XDP by putting “bypass: true” on my interface, af\_packets section and getting warning like this **[3301] Warning: af-packet: ens3f0np0: XDP filter set but XDP support is not built-in** then after running suricata --build-info it printed **“eBPF support: no, XDP support: no”** 2. now, i know that i need to enable the mode in suricata and after reading the documentation multiple times, it need to be on the./configure level meaning i havet rebuild/compile the suricata using the git. so i did but i encountered many problems: - i use the “git clone [GitHub - OISF/suricata: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.](https://github.com/OISF/suricata.git)”, then i run everything including the make file then i get an error from the rust, which says Making install in src make[2]: Entering directory ‘/home/rayyan/download/ebpf\_suricata/src’ CC main.o CC alert-debuglog.o In file included from output-file.h:29, from output.h:40, from alert-debuglog.c:47: rust.h:24:10: fatal error: rust-bindings.h: No such file or directory 24 | #include “rust-bindings.h” | ^ ~~~~~~~~~~~~~~~~ compilation terminated. make[2]: \*\*\* [Makefile:3380: alert-debuglog.o] Error 1 make[2]: Leaving directory ‘/home/rayyan/download/ebpf\_suricata/src’ make[1]: \*\*\* [Makefile:500: install-recursive] Error 1 make[1]: Leaving directory ‘/home/rayyan/download/ebpf\_suricata’ make: \*\*\* [Makefile:925: install-full] Error 2 any thoughts on how to enable eBPF and XDP mode in suricata the simple way? ---
**Author:** ![lukashino](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/lukashino/32/1150_2.png) [@lukashino](https://forum.suricata.io/u/lukashino)\ **Post date:** [August 20, 2024, 8:05am UTC](https://forum.suricata.io/t/enable-ebpf-and-xdp-mode-in-suricata/4817/2 "2024-08-20T08:05:43Z")
Hello, I think it is related to the upgraded cbindgen which broke the build. What is your cbindgen version? `cbindgen --version` If it is 0.27.0 then the problem is likely related. The problem is fixed in master and will be fixed in 7.0.7 Until then you can build it using the older cbindgen version by uninstalling the current cbindgen and installing the older version by using: `cargo install cbindgen@0.26.0` Otherwise you can also try `make clean && make -j` to retry the compilation. Edit: it has been fixed in main-7.0.x branch (future 7.0.7 branch) Can you confirm the cbindgen version? ---
**Author:** ![rayyanekaputra](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/rayyanekaputra/32/3078_2.png) [@rayyanekaputra](https://forum.suricata.io/u/rayyanekaputra)\ **Post date:** [August 20, 2024, 8:20am UTC](https://forum.suricata.io/t/enable-ebpf-and-xdp-mode-in-suricata/4817/3 "2024-08-20T08:20:33Z")
![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/a/a27f7ae127472acd1945431b60cbad7e57ef6f95.png) confirmed, cbindgen is version 0.27.0. and did downgraded to 0.26.0 after checking ![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/0/05da7d3bb698774a975c4a405193956b93916040.png) still got the same issue with the rust-bindings.h ---
**Author:** ![rayyanekaputra](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/rayyanekaputra/32/3078_2.png) [@rayyanekaputra](https://forum.suricata.io/u/rayyanekaputra)\ **Post date:** [August 20, 2024, 8:22am UTC](https://forum.suricata.io/t/enable-ebpf-and-xdp-mode-in-suricata/4817/4 "2024-08-20T08:22:06Z")
should i downgrade to suricata 6.0.0 to avoid this issue? ---
**Author:** ![lukashino](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/lukashino/32/1150_2.png) [@lukashino](https://forum.suricata.io/u/lukashino)\ **Post date:** [August 20, 2024, 8:48am UTC](https://forum.suricata.io/t/enable-ebpf-and-xdp-mode-in-suricata/4817/5 "2024-08-20T08:48:36Z")
You can try `make clean` and then compile it again Alternatively, you can do a compilation from a fresh folder - clone Suricata to a different folder or remove and reclone to the same one. Alternatively#2, you can switch to main-7.0.x `git checkout main-7.0.x` Suricata 6.0.x is the end of life so there is no support, I think the issue would be present there anyway. Edit: can you confirm that your cbindgen is really 0.26.0 after the downgrade? ---
**Author:** ![rayyanekaputra](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/rayyanekaputra/32/3078_2.png) [@rayyanekaputra](https://forum.suricata.io/u/rayyanekaputra)\ **Post date:** [August 20, 2024, 11:26am UTC](https://forum.suricata.io/t/enable-ebpf-and-xdp-mode-in-suricata/4817/6 "2024-08-20T11:26:13Z")
![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/7/77138950f3f4017d92a8b318b6372cb585547683.png) apparently it has different version accross user. trying to recompile right now ---
**Author:** ![rayyanekaputra](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/rayyanekaputra/32/3078_2.png) [@rayyanekaputra](https://forum.suricata.io/u/rayyanekaputra)\ **Post date:** [August 20, 2024, 11:58am UTC](https://forum.suricata.io/t/enable-ebpf-and-xdp-mode-in-suricata/4817/7 "2024-08-20T11:58:17Z")
![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/2/2e4e6978539fcc0af14c3e7647c478a8a75b6ab0.png) new error has been produced after compiling. this is using git branch from main-7.0.x and cbindgen 0.26.0. ![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/4/4ffc871e42180cb147db465f379d349930c27699.png) these are executed **not in sudo** ---
**Author:** ![lukashino](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/lukashino/32/1150_2.png) [@lukashino](https://forum.suricata.io/u/lukashino)\ **Post date:** [August 20, 2024, 12:06pm UTC](https://forum.suricata.io/t/enable-ebpf-and-xdp-mode-in-suricata/4817/8 "2024-08-20T12:06:46Z")
great to hear that! Btw just to confirm can you now build Suricata without ebpf switches? Can you verify you installed all the required ebpf dependencies? I think the only one should be `sudo apt install libbpf-dev` Then use both ebpf switches: `--enable-ebpf --enable-ebpf-build` with the configure script. ---
**Author:** ![rayyanekaputra](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/rayyanekaputra/32/3078_2.png) [@rayyanekaputra](https://forum.suricata.io/u/rayyanekaputra)\ **Post date:** [August 20, 2024, 12:47pm UTC](https://forum.suricata.io/t/enable-ebpf-and-xdp-mode-in-suricata/4817/9 "2024-08-20T12:47:56Z")
> Can you verify you installed all the required ebpf dependencies? > I think the only one should be: > `sudo apt install libbpf-dev` > > ![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/4/4198f95d88cf249ae84cc8ef1d9a84296f4d1d54.png) > Then use both ebpf switches: > `--enable-ebpf --enable-ebpf-build` with the configure script. > > ![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/e/ecaa36d59cb802ae7e8001ef25addf9f4f443a84.png) confirmed, successfully make/compile without the ebpf flags ![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/3/30c7a9d891535e2a3cad0229d3ed720f2b16cda6.png) what should i do from here? i can tell that the esbpf source code are having issues ---
**Author:** ![lukashino](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/lukashino/32/1150_2.png) [@lukashino](https://forum.suricata.io/u/lukashino)\ **Post date:** [August 20, 2024, 2:20pm UTC](https://forum.suricata.io/t/enable-ebpf-and-xdp-mode-in-suricata/4817/10 "2024-08-20T14:20:59Z")
You can check dependencies and steps from this build - it is from Debian but same/similar instructions should apply for Ubuntu > I wanted to suggest to check you have the latest version but yes, you have the same as me. On my PC it is: ```auto dpkg -s libbpf-dev | grep Version Version: 1:0.5.0-1ubuntu22.04.1 ``` This also find me the function on my PC - does it for you? ```auto grep bpf_set_link_xdp_fd /usr/include/bpf/libbpf.h ``` It’s likely some linking issue, I can compile well on my machine (and it is compiled within Suri CI) so code should not be the issue. ---
**Author:** ![rayyanekaputra](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/rayyanekaputra/32/3078_2.png) [@rayyanekaputra](https://forum.suricata.io/u/rayyanekaputra)\ **Post date:** [August 20, 2024, 3:12pm UTC](https://forum.suricata.io/t/enable-ebpf-and-xdp-mode-in-suricata/4817/11 "2024-08-20T15:12:36Z")
> [@lukashino](#): > > `grep bpf_set_link_xdp_fd /usr/include/bpf/libbpf.h` ![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/d/d6b2d844dab4ac14c9af1719263c7ccb0b88d69f.png) yeah it doesnt show anything, how do i fix this linking issue? is it with the `sudo ldconfig` provided within the documentation? ![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/f/f6418f45113eb757096b93ecfefd4435eef433db.png) ---
**Author:** ![lukashino](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/lukashino/32/1150_2.png) [@lukashino](https://forum.suricata.io/u/lukashino)\ **Post date:** [August 21, 2024, 6:14am UTC](https://forum.suricata.io/t/enable-ebpf-and-xdp-mode-in-suricata/4817/12 "2024-08-21T06:14:41Z")
I would try to: 1. remove and install libbpf-dev again 2. remove libbpf-dev and install it manually ldconfig is needed after manual install of the ebpf library to update library sources in the system ---
**Author:** ![rayyanekaputra](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/rayyanekaputra/32/3078_2.png) [@rayyanekaputra](https://forum.suricata.io/u/rayyanekaputra)\ **Post date:** [August 21, 2024, 7:28am UTC](https://forum.suricata.io/t/enable-ebpf-and-xdp-mode-in-suricata/4817/13 "2024-08-21T07:28:21Z")
resolved! thank you. that fixes the linking problem by reinstalling. ![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/c/c57b93b121361d3628fbce7a2ccb40b6e107f164.png) For everyone: i cant tell which one is the “only” solution, but you have to go through all of this as this was written "step-by-step: by me and @lukashino