Error in the use of Suricata with dpdk

Help
1

Hello all,
I’m a new user of Suricata.I’m working on a project that uses Suricata based on DPDK, but I’m having some problems running it.

  1. Use the Suricata master branch dependency（7.0.0-dev） after dpdk-22.07 compiles.I am working for it on Ubuntu20.04.
  2. These graphs show the status of the NIC driver and hugepages：
    image

image
image987×244 23.5 KB

3.nano /etc/suricata/suricata.yaml

image
image1050×1219 141 KB

4.This is the error：

image
image1611×472 144 KB

(DeviceConfigure) – [ERRCODE: SC_ERR_DPDK_INIT(340)] - Number of configured RX queues of 0000:02:05.0 is higher than maximum allowed (1)
(ParseDpdkConfigAndConfigureDevice) – [ERRCODE: SC_ERR_DPDK_CONF(343)] - Device 0000:02:05.0 fails to configure

This research is very important for my subject, I hope to get your help, thank you!!!

2

I know from other places that the number of RX_queues and TX_queues of virtual machines is 1, but I don’t know how to set up the number of RX queues in Suricata.yaml.

3

To test current RSS queue count of eth1: ethtool -l eth1

To change it to 1 queue: ethtool -L eth1 combined 1

4

Thanks for your replying！But if I bind ens33 and dpdk’s igb_uio driver, the following error occurs when I run this command:
image

Doing this command before binding the interface will result in an error:
ethtool -L ens33 combined 1
netlink error: Operation not supported

5

Once you bind the nic with dpdk it will bypass the kernel hence the nic will not be visible to ethtool

Can you please run and post the output : ethtool -i ens33

6

Thank you for your ideas. I have found the solution to this problem. The problem can be solved by setting up RX queues using the tool provided by DPDK，Thank you！！

1 Like
7

could you please tell me how to do it in detail,thank you