Hello!
I use Suricata in IDS mode on a proxmox server hosting several KVM virtual machines, trying to protect those virtual machines from brute force, minor DDoS attacks, etc.
The problem I’m facing is that even if the only rule file is empty, installing packages via pkg/portsnap on KVM virtual machines with FreeBSD does not work (It gets stuck instantly or after 1-2 seconds).
If I run `systemctl stop suricata’ at the proxmox level, everything works normally.
Any idea what’s going on and how I could solve this problem?
/etc/suricata/suricata.yaml: %YAML 1.1---# Suricata configuration file. In addition to the comments des - Pastebin.com
What version are you using?
How does your suricata.yaml look like?
How exactly do you start Suricata?
Also add the stats.log
Hey!
suricata.yaml is listed in the first msg.
stats.yaml cannot be retrieved at this moment beause there are plenty of VMs which are not using FreeBSD and are in production
There is a vmbr0 interface configured, so are you running Suricata on Linux or FreeBSD?
Still we need the version of Suricata and also how you run it, so we know which runmode you use.
I’m talking about the stats.log from Suricata, that should have no impact on any machine looking into the stats.log from Suricata.
Suricata is running on proxmox node, where vmbr0 is the brindge attached to each virtual machine - FreeBSD machine included.
Regarding the version: This is Suricata version 6.0.10 RELEASE running in SYSTEM mode
Output of stats.log after getting blocked:
------------------------------------------------------------------------------------
Date: 8/6/2023 -- 11:19:00 (uptime: 0d, 00h 03m 13s)
------------------------------------------------------------------------------------
Counter | TM Name | Value
------------------------------------------------------------------------------------
decoder.pkts | Total | 49156
decoder.bytes | Total | 26676152
decoder.ipv4 | Total | 48704
decoder.ipv6 | Total | 452
decoder.tcp | Total | 19536
decoder.udp | Total | 182
decoder.icmpv4 | Total | 29118
decoder.icmpv6 | Total | 320
decoder.avg_pkt_size | Total | 542
decoder.max_pkt_size | Total | 1500
flow.tcp | Total | 138
flow.udp | Total | 55
flow.icmpv4 | Total | 14843
flow.icmpv6 | Total | 3
flow.wrk.spare_sync_avg | Total | 100
flow.wrk.spare_sync | Total | 189
flow.wrk.flows_evicted | Total | 991
tcp.sessions | Total | 68
tcp.syn | Total | 114
tcp.synack | Total | 49
tcp.rst | Total | 33
detect.alerts_suppressed | Total | 246
app_layer.flow.ntp | Total | 12
app_layer.flow.ikev2 | Total | 2
app_layer.tx.ikev2 | Total | 4
app_layer.flow.failed_udp | Total | 41
ips.accepted | Total | 49125
ips.blocked | Total | 588
flow.mgr.full_hash_pass | Total | 1
flow.spare | Total | 10051
flow.mgr.rows_maxlen | Total | 3
flow.mgr.flows_checked | Total | 5820
flow.mgr.flows_notimeout | Total | 1814
flow.mgr.flows_timeout | Total | 4006
flow.mgr.flows_evicted | Total | 4006
tcp.memuse | Total | 38797312
tcp.reassembly_memuse | Total | 6291456
flow.memuse | Total | 12130304
How do you start Suricata? Which command line arguments to do you pass to the binary?