# Suricata ignoring vxlan traffic **URL:** \ **Category:** Help\ **Created:** [August 12, 2021, 4:45am UTC](https://forum.suricata.io/t/suricata-ignoring-vxlan-traffic/1606 "2021-08-12T04:45:23Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![darrinh](https://avatars.discourse-cdn.com/v4/letter/d/a87d85/32.png) [@darrinh](https://forum.suricata.io/u/darrinh)\ **Post date:** [August 12, 2021, 4:45am UTC](https://forum.suricata.io/t/suricata-ignoring-vxlan-traffic/1606/1 "2021-08-12T04:45:23Z")
Hi all, I’m trying to setup suricata with AWS traffic mirroring. The mirroring part works as I can see the mirrored packets arriving on the interface of the target ec2 instance. Note that suricata in this instance is a out-of-the-box ubuntu installation. - tcpdump -nnni eth0 udp port 4789 - shows the traffic arriving on the interface I tried creating a virtual interface as I had seen that mentioned in a few places: - ip link add vxlan0 type vxlan id 12345 dev eth0 dstport 4789 • ip link set vxlan0 up I can see the same mirrored traffic arriving on that interface, however suricata seems to ignore it. What settings are required for suricata to work with mirrored traffic? many thanks Darrin ---
**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\ **Post date:** [August 12, 2021, 8:10am UTC](https://forum.suricata.io/t/suricata-ignoring-vxlan-traffic/1606/2 "2021-08-12T08:10:27Z")
Hi, which version of Suricata are you running exactly? I would recommend using the PPA since the only Suricata I’ve seen in Ubuntu is in 18.04 and that’s 3.2 which is EOL for a long time and doesn’t support VXLAN. With a more recent version VXLAN support is builtin, you just need to ensure the VXLAN\_PORT value is set correct, which it should by default. ---
**Author:** ![pevma](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/pevma/32/29_2.png) [@pevma](https://forum.suricata.io/u/pevma)\ **Post date:** [August 12, 2021, 1:28pm UTC](https://forum.suricata.io/t/suricata-ignoring-vxlan-traffic/1606/3 "2021-08-12T13:28:36Z")
One thing to consider is also increasing the default-packt size in yaml if needed. ---
**Author:** ![darrinh](https://avatars.discourse-cdn.com/v4/letter/d/a87d85/32.png) [@darrinh](https://forum.suricata.io/u/darrinh)\ **Post date:** [August 13, 2021, 12:36am UTC](https://forum.suricata.io/t/suricata-ignoring-vxlan-traffic/1606/4 "2021-08-13T00:36:46Z")
Hi Andreas, It was on 6.0.3, which I think is the most recent version, I’m using ubuntu 20.04. thanks Darrin ---
**Author:** ![darrinh](https://avatars.discourse-cdn.com/v4/letter/d/a87d85/32.png) [@darrinh](https://forum.suricata.io/u/darrinh)\ **Post date:** [August 13, 2021, 1:34am UTC](https://forum.suricata.io/t/suricata-ignoring-vxlan-traffic/1606/5 "2021-08-13T01:34:21Z")
Hi Peter, I did notice that the mirror source had an mtu of 9001 (ec2 instance) but the destination had an mtu of 1500. I recreated the destination with a different instance type and adjusted the source mtu as per the documentation: > For example, if an 8996 byte packet is mirrored, and the traffic mirror target MTU value is 9001 bytes, > the mirror encapsulation results in the mirrored packet being greater than the MTU value. In this case, > the mirror packet is truncated. To prevent mirror packets from being truncated, set the traffic mirror > source interface MTU value to 54 bytes less than the traffic mirror target MTU value for IPv4 and 74 > bytes less than the traffic mirror target MTU value when you use IPv6. Therefore, the maximum MTU > value supported by Traffic Mirroring with no packet truncation is 8947 bytes So after that, I can see vxlan traffic by doing: - tcpdump -nnni ens3 udp port 4789 I can now see some activity in the eve log: `{"timestamp":"2021-08-13T01:24:45.199573+0000","flow_id":707066668330639,"in_iface":"ens3","event_type":"flow","src_ip":"a.a.a.a","src_port":65452,"dest_ip":"b.b.b.b","dest_port":4789,"proto":"UDP","app_proto":"failed","flow":{"pkts_toserver":18,"pkts_toclient":15,"bytes_toserver":7674,"bytes_toclient":6230,"start":"2021-08-13T01:23:37.339599+0000","end":"2021-08-13T01:24:09.590299+0000","age":32,"state":"new","reason":"timeout","alerted":false}}` Not sure why its not showing the actual mirrored packets. thanks darrin ---
**Author:** ![darrinh](https://avatars.discourse-cdn.com/v4/letter/d/a87d85/32.png) [@darrinh](https://forum.suricata.io/u/darrinh)\ **Post date:** [August 13, 2021, 3:27am UTC](https://forum.suricata.io/t/suricata-ignoring-vxlan-traffic/1606/6 "2021-08-13T03:27:59Z")
thanks all, seems to be working after adjusting the mtu and also adding outbound rules in for the mirroring filter. many thanks darrin