Running suricata in single threaded mode with windivert module

Help
,
1

How can we run Suricata in single threaded mode with windivert?

Using the below command:
suricata.exe -c suricata.yaml --windivert “true”
I got this as output.

image
image960×188 8.28 KB

How do I make packet processing threads and management threads initialized to 1.

The runmode type for windivert is : autofp only, below is the attachment:

image
image778×33 1.51 KB

Is it possible to make suricata run on single thread with windivert?

2

I didn’t try it on windivert but you can control the cpu affinity in the config file, see 10.1. Suricata.yaml — Suricata 6.0.10 documentation

3

@Andreas_Herz
I made the changes in the yaml file as you said,

image
image960×188 8.28 KB

But I could not change the packet processing threads.

Here is the output to list the runmode:

MicrosoftTeams-image
MicrosoftTeams-image1338×381 14.7 KB

Here, by default windivert is working on multi-thread.

Is there any way to change it or should I compile the source code and make the changes?

4

Please paste your config file first so we can check the settings.

5

@Andreas_Herz
Sure, this is the config file:
suricata.yaml (72.7 KB)
Let me know if any other changes are required.
Thanks

6

First of all I just noticed you are using 6.0.0 beta1, please use the stable 6.0.10 release.

Second, you can chance the prio section in the affinity to also use just the core 0 and in addition to that feel free to try out the detect-thread-ratio setting and reduce it to 0.5 or even lower.

I personally never tried it on windows, so see those second points just as possible suggestion. Also what CPU is used in that scenario?

7

Hi @Andreas_Herz
I used 6.0.0 beta1 because in that installer, windivert was enabled. I tried with the 6.0.10, but windivert was disabled.
I tried with with the points which you shared, by reducing thread-ratio, but the thread count was not set to 1.
I am using it on the machine with 8 CPU and 8 cores.
If there is any other solution, please share it.
Thank you.

8

Check:
https://www.openinfosecfoundation.org/downloads/windows/

E.g. 6.0.10:
https://www.openinfosecfoundation.org/downloads/windows/Suricata-6.0.10-windivert-1-64bit.msi

9

Hi @vjulien
Thank you for sharing the link.
I installed this and tried to run suricata with windivert and made the changes in the configuration file to make it single threaded, but still it runs in multi-threaded mode itself.

10

Looks like no “single” mode is implemented for our windivert integration.

1 Like
11

@vjulien Thank you for the help :slightly_smiling_face: