TCPv4 invalid checksum and truncated packet - 7.0.10

Help
1
  • Suricata version: 7.0.10
  • Operating system and/or Linux distribution: Ubuntu 24.04.02 VM on Proxmox 8.3.0 + QEMU
  • How you installed Suricata: Package

Hello, our recent installations have a lot of these alerts:

55474 SURICATA TCPv4 invalid checksum.
19119 SURICATA AF-PACKET truncated packet.
19119 SURICATA IPv4 truncated packet.

Because of these alerts, our custom made IDS struggles to process the .json files generated by suricata, and in addition, these json files are of a considerable size unlike all other installations.

What could be the cause and possible solution?

Thank you

2

Are you monitoring a physical interface inside the VM? Or one that is part of a bridge? If so, you likely need to disable hardware offloading on the physical interface.

I run this script on my proxmox host at boot:

#! /bin/sh

IF=$1

off=${OFF:-off}

ethtool -K ${IF} tso ${off}
ethtool -K ${IF} gro ${off}
ethtool -K ${IF} lro ${off}
ethtool -K ${IF} gso ${off}
ethtool -K ${IF} rx ${off}
ethtool -K ${IF} tx ${off}
ethtool -K ${IF} sg ${off}
ethtool -K ${IF} rxvlan ${off}
ethtool -K ${IF} txvlan ${off}

Something like:

disable-offload.sh enp0s31f6
3

Hello Jason, thank you for your reply.

The interface is part of a bridge.

We would like to avoid disabling the offload checksum. Would setting the PCI passthrough of the NIC to the VM be a solution?

Since this is the first time these types of problems have occurred, I would also ask if a solution could be to modify the above rules or if some specific configuration of the suricata.yaml could help.

Thanks

4

Passthrough could work. Then Suricata will disable the offloads for you.

It would be the first thing I’d try.

These signatures are just reporting what they see, so the only modification would be to disable them. As it usually represents a problem in the setup, quite often hardware offloads.

5

Thanks Jason, no doubt we will try pcie passtrough.

As for disabling the rule or hardware offload, in these two cases could it affect Suricata’s ability to detect evasion methods such as checksum manipulation?

6

I’m not exactly sure the details of what checksum manipulation looks like. But for Suricata to properly determine what the checksum is, hardware offloading needs to be disabled. So disabling offloads should only help here.