I have the following configuration of suricata in af packet for two vNICs named idps0
and idps1
respectively:
af-packet:
- interface: idps0
threads: 1
defrag: yes
cluster-type: cluster_flow
cluster-id: 98
copy-mode: tap
copy-iface: idps1
buffer-size: 64535
use-mmap: yes
- interface: idps1
threads: 1
cluster-id: 97
defrag: yes
cluster-type: cluster_flow
copy-mode: tap
copy-iface: idps0
buffer-size: 64535
use-mmap: yes
However this symmetric configuration creates an infinite loop of packets between the NICs. When I tried to remove the copy-iface
variable from the second interface or the entry of the second interface altogether Suricata fails with error: Some IPS capture threads did not peer.
Can someone please help?