IP packet handling issues in virtio-net on certain OS/kernel versions on KVM VM

Help
3

  1. IPS VM is Fedora 36. Host Machine is Fedora 35.

  2. Hypervisor configuration was performed using libvirtd, a VM management tool of KVM. The current configuration is the same as in Figure 1.

  3. The two interfaces used as af-packet pairs in Suricata VMs handle communication between the internal VMs, not the external internet, so only the internal interfaces are used.

  4. Result of packet response (SYN-ACK) according to vNIC from Suricata VM (client makes a request to HTTP server with curl and receives 200 OK response)

    linux bridge (Suricata Process Off)
    - virtio: Success
    - e1000: Sucess

    Suricata af-packet (linux bridge Off)
    - virtio: Fail
    - e1000: Sucess

The af-packet in Suricata VM configured with Fedora 36 on Hyper-V worked fine.
In addition, in very few cases, a packet response may come in virtio mode. However, there were a lot of retransmissions and it took a very long time to get a response. See Figure 3.

image
image756×331 8.97 KB

Fig. 1 Suricata VM Network Config

image
image1054×326 4.56 KB

Fig. 2 VM/Network Diagram

image
image1161×511 10.6 KB

Fig. 3 tcpdump capture from server