Error in the use of Suricata with dpdk

Hello all,
I’m a new user of Suricata.I’m working on a project that uses Suricata based on DPDK, but I’m having some problems running it.

  1. Use the Suricata master branch dependency(7.0.0-dev) after dpdk-22.07 compiles.I am working for it on Ubuntu20.04.
  2. These graphs show the status of the NIC driver and hugepages:

3.nano /etc/suricata/suricata.yaml

4.This is the error:

(DeviceConfigure) – [ERRCODE: SC_ERR_DPDK_INIT(340)] - Number of configured RX queues of 0000:02:05.0 is higher than maximum allowed (1)
(ParseDpdkConfigAndConfigureDevice) – [ERRCODE: SC_ERR_DPDK_CONF(343)] - Device 0000:02:05.0 fails to configure

This research is very important for my subject, I hope to get your help, thank you!!!

I know from other places that the number of RX_queues and TX_queues of virtual machines is 1, but I don’t know how to set up the number of RX queues in Suricata.yaml.

To test current RSS queue count of eth1: ethtool -l eth1

To change it to 1 queue: ethtool -L eth1 combined 1

Thanks for your replying!But if I bind ens33 and dpdk’s igb_uio driver, the following error occurs when I run this command:

Doing this command before binding the interface will result in an error:
ethtool -L ens33 combined 1
netlink error: Operation not supported

Once you bind the nic with dpdk it will bypass the kernel hence the nic will not be visible to ethtool

Can you please run and post the output : ethtool -i ens33

Thank you for your ideas. I have found the solution to this problem. The problem can be solved by setting up RX queues using the tool provided by DPDK,Thank you!!

1 Like