Please include the following information with your help request:
8.0.6 Suricata af-packet ips-copy
Linux Mint Cinnamon latest release
Source build in place
13900HK / 16Gb ddr4 3200 / Dual Intel 226v nics /
Creating a new thread to troubleshoot.
I removed the box from service after a few weird things were happening, and I think I solved them all but this.
Unit sits between a Firewalla Gold Plus and a D-Link DMS-1250-52x.
I loaded all the rules and got it functioning, but didn’t start dropping (so it was still basically IDS) and some of the PC’s would drop offline and not come back up without a reboot, and two of my 3 VOIP devices lose connection and the only fix is to physically connect them to the Firewalla.
Even doing a disable/enable in windows and using netsh commands didn’t bring them back online.
Seems to happen when they’re online for over 3 hours and idle for at least an hour, they just drop and don’t come back.
Not sure where to look since the system should just be executing copies and not dropping packets (evebox says no drops)
When I pull the unit out and directly connect the firewalla to the switch, everything can go indefinitely with no disconnects.
The first thing I would check is the EEE settings.
Since the disconnects seem to occur after the devices have been online for several hours and then sit idle, I would eliminate EEE/power-management behavior before changing anything in Suricata itself.
Disable EEE on the D-Link port connected to the Suricata box and on both physical NICs in the Suricata Windows system. Also disable the Windows NIC option that allows Windows to turn the adapter off to save power.
Don’t change anything else, Suricata, the rules, the Firewalla configuration, or the rest of the switch configuration. Let it run for at least 24 hours, assuming it makes it that long.
If the disconnects stop, that should give you a pretty strong indication that the issue is related to NIC/EEE power management rather than Suricata rules or packet dropping.
I’m just guessing at this point and could be completely off base.
EEE is off across the network as a whole (each switch is set to off, as well as the two nics on the suricata box and any nic I can find it on, along with all other power save features) but it was a good idea to check.
If I had to guess, I’d bet it’s related to the VOIP devices dropping offline as soon as the suricata box is connected…something isn’t working and I don’t know what.
The weird part is I have 3 VOIP devices and two drop, but the third shows zero issues.
my Polycom E450 drops off within a few minutes and never comes back even on a reboot, my OBI302 connects, gets a live connection, and drops 30 seconds later (every time I reboot it), but the Grandstream HT802 has no problems whatsoever.
The logs on evebox show no drops of any kind and I have turned off, disabled and hidden crowdsec until I can solve this.
Only thing I can find similar to this is from a release a couple years ago where tons of devices just dropped and people rolled back until it was fixed
Something to try, but it might be a bit of a stretch, is toggling the global exception policy:
By default, Suricata will fail closed if there is a protocol parsing issue. Look for anomaly issues.
By setting the default exception policy to ignore, Suricata will still pass the packet when it can’t parse the protocol. Worth a try, and/or in your af-packet setting copy mode to tap for a while.
