Suricata with passive optical TAP

[litinoveweedle]

@Andreas_Herz

Passive TAP works as long as you install them on a wire where both directions of a traffic is seen. I have several of those setups where it’s ensured to see it.
Within the “RX” from the TAP towards the Sensor where Suricata is running no “TX” is needed but within the RX is the actual traffic that was seen by the TAP.

You could try bridging the two interfaces in Linux and set the bridge as capture device, the last time I tried this it was even worse. But maybe it’s working now.
Despite that I would recommend to ensure that you find a way to place the TAP on a place where bidirectional traffic is seen.

I am afraid, that I don’t understand your reply. Fibre optic TAP see both directions of the traffic, but it will copy it to separate fibres, which than has to be connected to TWO separate network interfaces. This is the issue I tried to describe.

So I am looking to advise, how Suricata shall be setup, to be able to reconstruct flows, where outgoing traffic is seen on interface1, while incoming traffic is seen on interface2.

I am definitely ready to prepare docs update by myself, but I will need information how Suricata works internally.

@Andreas_Herz

You brought up the IPS mode but there it’s also relevant to have both directions on each interface. Given a flow 10.0.0.1 to 10.0.0.2 you receive the initial packet from 10.0.0.1 to 10.0.0.2 on eno1 and copy this to eno2 where it’s moving to 10.0.0.2. The response from 10.0.0.2 is coming in into eno2 and copied to eno1 and passing to 10.0.0.1. So on eno1 and eno2 you see the "same’ traffic bidirectional.

I highly doubt, that Suricata inspect both eno1 and eno2 traffic, because it will simply do scanning of the same traffic twice! Based on my expectations Suricata will probably inspect only incoming traffic, not outgoing on both interfaces. Or both directional traffic but only on one interface.

But in the current IPS mode documentation, BOTH interfaces are setup to be monitored by Suricata. So there has to be some internal mechanism, at least I hope so.