Suricata in AF_PACKET mode creates an inifinite loop

Help
,
1

I have the following configuration of suricata in af packet for two vNICs named idps0 and idps1 respectively:

af-packet:
  - interface: idps0
    threads: 1
    defrag: yes
    cluster-type: cluster_flow
    cluster-id: 98
    copy-mode: tap
    copy-iface: idps1
    buffer-size: 64535
    use-mmap: yes
  - interface: idps1
    threads: 1
    cluster-id: 97
    defrag: yes
    cluster-type: cluster_flow
    copy-mode: tap
    copy-iface: idps0
    buffer-size: 64535
    use-mmap: yes

However this symmetric configuration creates an infinite loop of packets between the NICs. When I tried to remove the copy-iface variable from the second interface or the entry of the second interface altogether Suricata fails with error: Some IPS capture threads did not peer.

Can someone please help?

2

How are the vNICs configured and what is their position in your network?

3

They are created as a “dummy” vnic inside the host running suricata i.e.:
ip link add idps0 type dummy
ip link set idps0 up

I am running suricata using the following cmd:

 sudo suricata -c suricata.yaml -s /opt/azfw/etc/suricata/rules/allrules.rules --af-packet
4

Linux dummy interfaces are interesting. I’ve tried them for “virtual” IPS testing, but every packet “injected” into them appears to be received and transmitted by the interface, making them not very useful for anything but light testing, and not for production use.

So I’m going to guess that is the source of your infinite loop.

Some thoughts:

5

@ish Have you heard or tried running suricata in af-packet mode on dummy interfaces in production?

I am considering some architecture that uses this option in order to alleviate the following known bug: Suricata behind proxy server - #8 by Knight (Suricata behined proxy)…

6

No, and I’m not sure how useful they would be. As mentioned above, the dummy interfaces have an echo effect limiting their use in IPS setups. They are fine for replaying traffic into and monitoring in IDS mode, but I haven’t been able to make much use of them for testing IPS modes.