# Suricata generating VXLAN + ICMP traffic

**URL:** <https://forum.suricata.io/t/suricata-generating-vxlan-icmp-traffic/1318>\
**Category:** Help\
**Created:** [April 27, 2021, 4:39pm UTC](https://forum.suricata.io/t/suricata-generating-vxlan-icmp-traffic/1318 "2021-04-27T16:39:11Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![zlvinas](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/zlvinas/32/324_2.png) [@zlvinas](https://forum.suricata.io/u/zlvinas)\
**Post date:** [April 27, 2021, 4:39pm UTC](https://forum.suricata.io/t/suricata-generating-vxlan-icmp-traffic/1318/1 "2021-04-27T16:39:12Z")

</div>

We have a setup where Suricata (5.0.2) is running only as IDS and is receiving mirrored traffic via VXLAN protocol. We noticed that there is an ICMP traffic wrapped in VXLAN generated by Suricata that is flowing back to the instance that VXLAN is mirrored from. Tested this by running process without Suricata and with Suricata.

VXLAN + ICMP traffic has properties:

 ![Screenshot 2021-04-27 at 17.34.15](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/1X/790af7493cd0656c320313afd5b6a3247f3cfec3.png)

My question is why we are seeing this traffic? Can Suricata be configured to disable sending traffic back to instance?

**Edit 1**  
We are using AWS services. Topology:

 ![Untitled](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/1X/9a415255f2f4bebd379fd4f5ef7d9a30b07bfd22.png)

We only have `alert` rules.

Suricata is being configured:

```auto
./configure --enable-nfqueue \
            --enable-python \
            --enable-lua \
            --with-libnetfilter_queue-libraries=...
            --with-libnetfilter_queue-includes=...
            --with-libhs-includes=...
            --with-libhs-libraries=...
            --with-liblua-includes=...
            --with-liblua-libraries=...
            --with-libnet-libraries=...
            --with-libnet-includes=...
            --with-libnspr-libraries=...
            --with-libnspr-includes=...
            --with-libnss-libraries=...
            --with-libnss-includes=...
            --disable-gccmarch-native \
            "--prefix=..."

```

---

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\
**Post date:** [April 28, 2021, 11:30am UTC](https://forum.suricata.io/t/suricata-generating-vxlan-icmp-traffic/1318/2 "2021-04-28T11:30:43Z")

</div>

Hi,  
Suricata doesn’t transmit packets in IDS mode. In IDS mode, Suricata normally receives traffic from a TAP or SPAN port. These are unidirectional.

Can you explain your deployment topology?

---

<div class="post-metadata">

**Author:** ![zlvinas](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/zlvinas/32/324_2.png) [@zlvinas](https://forum.suricata.io/u/zlvinas)\
**Post date:** [April 28, 2021, 2:16pm UTC](https://forum.suricata.io/t/suricata-generating-vxlan-icmp-traffic/1318/3 "2021-04-28T14:16:52Z")

</div>

Added more details in Edit 1. Please let me know if you need more details. Thanks!

---

<div class="post-metadata">

**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\
**Post date:** [April 28, 2021, 8:57pm UTC](https://forum.suricata.io/t/suricata-generating-vxlan-icmp-traffic/1318/4 "2021-04-28T20:57:23Z")

</div>

How do you run/start suricata and can you also post the config yaml file?