Suricata with NFQUEUE as IPS - Slow network

Help
1

Hi everyone,

I have an inline IPS installation of suricata v4.1.10 on Centos 7 with NFQUEUE on a virtual Cloud environment.

The installation work fine but my network bandwith is divided by around 3 when activating inline IPS.

Is that normal ? I don’t expect to have full bandwith capacity with IPS but this is a huge difference (from 300 MBps to less than 100 MBps) ? I tried the tuning instructions provided by documentation but it did not helped.

Have you an idea of specific tuning to increase bandwith ?

Thanks for your help,

Ben

2

Pretty much the same figures here, on real hardware, same OS and Suricata version.
Minor improvements using NFQUEUE cpu-fanout on multicore hw, but beware of this bug.
You could also try Suricata v6 (@ish used to build rpms for CentOS 7).

3

Thanks for the answer.

I will check these improvements but I think I have find one of the big reason of the slow down, it seems to be in the rules definition.

Ben