# Suricata on ipip tunneled packets

**URL:** <https://forum.suricata.io/t/suricata-on-ipip-tunneled-packets/4850>\
**Category:** Help\
**Created:** [September 10, 2024, 10:51am UTC](https://forum.suricata.io/t/suricata-on-ipip-tunneled-packets/4850 "2024-09-10T10:51:20Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![vjulien](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/vjulien/32/4_2.png) [@vjulien](https://forum.suricata.io/u/vjulien)\
**Post date:** [September 11, 2024, 4:57am UTC](https://forum.suricata.io/t/suricata-on-ipip-tunneled-packets/4850/2 "2024-09-11T04:57:28Z")

</div>

I believe this PR might try to address a similar case:

> <https://github.com/OISF/suricata/pull/10214>
>
> If a Suricata inline IPS device is routing traffic over a non-encrypted tunnel, …like IPv6 tunnels, packets in a flow will be dropped and not be matched. e.g.
> 
> The following example is a Suricata inline IPS with an IPv6 tunnel:
> \`\`\`
> request: IPv4\]ICMP\] -\> |IPS| -\> IPv6\]IPv4\]ICMP\]
> reply: \<- |IPS| \<- IPv6\]IPv4\]ICMP\]
> \`\`\`
> Both the IPv4 request and IPv6 reply will be seen by Suricata on
> ingress. The flows will not be matched due to flow recursion level.
> 
> Optionally use pkt recursion level in flow hash. Excluding recursion level in flow hash allows matching of packet flows and defrag on an inline IPS Suricata scenario where the IPS device is a tunnel terminator.
> 
> Bug: #6260
> 
> Make sure these boxes are signed before submitting your Pull Request -- thank you.
> 
> \- \[✓\] I have read the contributing guide lines at https://docs.suricata.io/en/latest/devguide/codebase/contributing/contribution-process.html
> \- \[✓\] I have signed the Open Information Security Foundation contribution agreement at https://suricata.io/about/contribution-agreement/
> \- \[✓\] I have updated the user guide (in doc/userguide/) to reflect the changes made (if applicable)
> 
> Link to \[redmine\](https://redmine.openinfosecfoundation.org/projects/suricata/issues) ticket:
> https://redmine.openinfosecfoundation.org/issues/6260
> 
> Describe changes:
> Add config (decoder.recursion-level.use-for-tracking) to control the use of packet recursion level in flow matching. This is to support scenarios where Suricata inline IPS device is routing traffic over a non-encrypted tunnel, like IPv6 tunnels, packets in a flow will be dropped and not be matched. e.g.
> 
> The following example is a Suricata inline IPS with an IPv6 tunnel:
> request: IPv4\]ICMP\] -\> |IPS| -\> IPv6\]IPv4\]ICMP\]
> reply: \<- |IPS| \<- IPv6\]IPv4\]ICMP\]
> 
> Both the IPv4 request and IPv6 reply will be seen by Suricata on ingress. The flows will not be matched due to flow recursion level.
> 
> \### Provide values to any of the below to override the defaults.
> 
> To use a pull request use a branch name like \`pr/N\` where \`N\` is the
> pull request number.
> 
> Alternatively, \`SV\_BRANCH\` may also be a link to an
> OISF/suricata-verify pull-request.
> 
> https://github.com/OISF/suricata-verify/pull/1597
> 
> \`\`\`
> SV\_BRANCH=pr/1597
> \`\`\`

Currently Suricata will decode such packets just fine, but won’t match up both sides of the traffic in a flow due to the tunnel imbalance.

---

_[View the full topic](https://forum.suricata.io/t/suricata-on-ipip-tunneled-packets/4850)._