Feature request, requires Suricata support for innet 5 tuple mode

Help
1

In my production environment, traffic mirroring is done by encapsulating data packets in VXLAN format and sending them out. Unfortunately, due to some reasons, the agent collecting traffic mirroring always sends data with the same source port, which prevents me from using the cluster_per_flow configuration. Since their 5-tuple is always the same, Suricata’s multithreading cannot achieve load balancing. After running tcpdump, you will see data similar to this:

192.168.199.32.59293 > 192.168.1.200.4789
192.168.199.32.59293 > 192.168.1.200.4789
192.168.199.32.59293 > 192.168.1.200.4789
192.168.199.32.59293 > 192.168.1.200.4789

I encountered the same problem with Zeek, but Zeek supports more PF_RING cluster_type options than Suricata. I used the inner_flow_5_tuple mode to solve this problem.

Currently, Suricata does not seem to support this feature, so I am making a feature request. Is it possible to support this feature?

history topic: Does Suricata support cross-packet reassembly with PF_RING cluster_round_robin?

2

There’s an issue for this: Feature #5975: Add support for 'inner' PF_RING clustering modes - Suricata - Open Information Security Foundation

There’s a PR (in review) for the issue.

If you don’t want to wait for the PR process to complete, check out the branch and try a manual build.

3

Thx bro. I’d love to try this PR and verify that the problem is improved! I will give feedback later