Suricata ignoring vxlan traffic

Help
1

Hi all,
I’m trying to setup suricata with AWS traffic mirroring. The mirroring part works as I can see the mirrored packets arriving on the interface of the target ec2 instance. Note that suricata in this instance is a out-of-the-box ubuntu installation.

  • tcpdump -nnni eth0 udp port 4789 - shows the traffic arriving on the interface

I tried creating a virtual interface as I had seen that mentioned in a few places:

  • ip link add vxlan0 type vxlan id 12345 dev eth0 dstport 4789
    • ip link set vxlan0 up

I can see the same mirrored traffic arriving on that interface, however suricata seems to ignore it. What settings are required for suricata to work with mirrored traffic?

many thanks
Darrin

2

Hi,

which version of Suricata are you running exactly? I would recommend using the PPA since the only Suricata I’ve seen in Ubuntu is in 18.04 and that’s 3.2 which is EOL for a long time and doesn’t support VXLAN.

With a more recent version VXLAN support is builtin, you just need to ensure the VXLAN_PORT value is set correct, which it should by default.

3

One thing to consider is also increasing the default-packt size in yaml if needed.

4

Hi Andreas,
It was on 6.0.3, which I think is the most recent version, I’m using ubuntu 20.04.

thanks
Darrin

5

Hi Peter,
I did notice that the mirror source had an mtu of 9001 (ec2 instance) but the destination had an mtu of 1500. I recreated the destination with a different instance type and adjusted the source mtu as per the documentation:

For example, if an 8996 byte packet is mirrored, and the traffic mirror target MTU value is 9001 bytes,
the mirror encapsulation results in the mirrored packet being greater than the MTU value. In this case,
the mirror packet is truncated. To prevent mirror packets from being truncated, set the traffic mirror
source interface MTU value to 54 bytes less than the traffic mirror target MTU value for IPv4 and 74
bytes less than the traffic mirror target MTU value when you use IPv6. Therefore, the maximum MTU
value supported by Traffic Mirroring with no packet truncation is 8947 bytes

So after that, I can see vxlan traffic by doing:

  • tcpdump -nnni ens3 udp port 4789

I can now see some activity in the eve log:

{"timestamp":"2021-08-13T01:24:45.199573+0000","flow_id":707066668330639,"in_iface":"ens3","event_type":"flow","src_ip":"a.a.a.a","src_port":65452,"dest_ip":"b.b.b.b","dest_port":4789,"proto":"UDP","app_proto":"failed","flow":{"pkts_toserver":18,"pkts_toclient":15,"bytes_toserver":7674,"bytes_toclient":6230,"start":"2021-08-13T01:23:37.339599+0000","end":"2021-08-13T01:24:09.590299+0000","age":32,"state":"new","reason":"timeout","alerted":false}}

Not sure why its not showing the actual mirrored packets.

thanks

darrin

6

thanks all, seems to be working after adjusting the mtu and also adding outbound rules in for the mirroring filter.

many thanks
darrin