Multiple interfaces on the same machine

ADudeWhoSurfs · October 20, 2022, 4:06pm

Please accept my sincere apologies, please ignore my portion of above comment relating to tertiary-defined interface eno2np0… this was an extremely dumb typo of the interface eno2np1 and is no longer an issue.

Hello,
Apologies, but I managed to remediate the issue!

# Linux high speed capture support
af-packet:
  - interface: bond0
    # Number of receive threads. "auto" uses the number of cores
    threads: 20

20/10/2022 -- 22:12:44 - <Notice> - all 60 packet processing threads, 4 management threads initialized, engine started.
20/10/2022 -- 22:12:44 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:44 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:44 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:44 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:44 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:45 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:45 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:45 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:45 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:45 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:45 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:45 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:45 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:45 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:45 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:45 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:45 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:45 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:45 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:45 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:45 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:45 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:45 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:45 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:46 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:46 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:46 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:46 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:46 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:46 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:46 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:46 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:46 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:46 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:46 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:46 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:46 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:46 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:46 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:46 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:46 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:46 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:46 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:46 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:47 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:47 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:47 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:47 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:47 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:47 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:47 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:47 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:47 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:47 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:47 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:47 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:47 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:47 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:47 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:47 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120
20/10/2022 -- 22:12:47 - <Info> - All AFP capture threads are running.

I allocated (as per example config above) 20 cores to each interface (3 x 30 = 60 out of 80) as it looks like they were overlapping and causing the issue

This has also fixed suricatasc, thanks for all your help!!

suricatasc /var/run/suricata/suricata-command.socket
Command list: shutdown, command-list, help, version, uptime, running-mode, capture-mode, conf-get, dump-counters, reload-rules, ruleset-reload-rules, ruleset-reload-nonblocking, ruleset-reload-time, ruleset-stats, ruleset-failed-rules, register-tenant-handler, unregister-tenant-handler, register-tenant, reload-tenant, unregister-tenant, add-hostbit, remove-hostbit, list-hostbit, reopen-log-files, memcap-set, memcap-show, memcap-list, dataset-add, dataset-remove, iface-stat, iface-list, iface-bypassed-stat, ebpf-bypassed-stat, quit
>>>

Topic		Replies	Views
Rules for different network interfaces Help	7	1369	April 30, 2022
Suricata Logs from multiple interfaces Help	6	688	February 24, 2021
Can Suricata reassemble a flow from different network interfaces? Help	5	1431	June 26, 2020
Architecture help Help ips , community , centos	2	1245	November 29, 2020
$HOME_NET and multiple interfaces, plus deployment best practices Help	3	4368	June 27, 2020

Multiple interfaces on the same machine

Related topics