How to configure suricata IPS mode with AF-PACKET?

Help
, ,
1

i install suricata fresh on ubuntu 20.04

then i go in suricata.yml

i have two nic enp0s3 enp0s4
then i add this:
community-id: true
detect-engine:

  • rule-reload: true`
af-packet:
  - interface: enp0s3 
    threads: 1
    defrag: no
    cluster-type: cluster_flow
    cluster-id: 98
    copy-mode: ips
    copy-iface: enp0s4
    buffer-size: 64535
    use-mmap: yes
  - interface: enp0s4
    threads: 1
    cluster-id: 97
    defrag: no
    cluster-type: cluster_flow
    copy-mode: ips
    copy-iface: enp0s3 
    buffer-size: 64535
    use-mmap: yes

now i don’t understand how to start suricata in IPS mode and add any rule to test it or is there any further configuration to start suricata in IPS mode.

2

Hi,

This looks like a good start but cross-check your settings with those at 13. Setting up IPS/inline for Linux — Suricata 7.0.0-dev documentation

Ensure that Suricata is started with --af-packet – if everything else is fine – check suricata.log for errors – Suricata is now running in IPS mode