I have the following configuration of suricata in af packet for two vNICs named
- interface: idps0
- interface: idps1
However this symmetric configuration creates an infinite loop of packets between the NICs. When I tried to remove the
copy-iface variable from the second interface or the entry of the second interface altogether Suricata fails with error:
Some IPS capture threads did not peer.
Can someone please help?
How are the vNICs configured and what is their position in your network?
They are created as a “dummy” vnic inside the host running suricata i.e.:
ip link add idps0 type dummy
ip link set idps0 up
I am running suricata using the following cmd:
sudo suricata -c suricata.yaml -s /opt/azfw/etc/suricata/rules/allrules.rules --af-packet
Linux dummy interfaces are interesting. I’ve tried them for “virtual” IPS testing, but every packet “injected” into them appears to be received and transmitted by the interface, making them not very useful for anything but light testing, and not for production use.
So I’m going to guess that is the source of your infinite loop.
@ish Have you heard or tried running suricata in
af-packet mode on dummy interfaces in production?
I am considering some architecture that uses this option in order to alleviate the following known bug: Suricata behind proxy server - #8 by Knight (Suricata behined proxy)…
No, and I’m not sure how useful they would be. As mentioned above, the dummy interfaces have an echo effect limiting their use in IPS setups. They are fine for replaying traffic into and monitoring in IDS mode, but I haven’t been able to make much use of them for testing IPS modes.