There are too many suricata processes when run inline using IPFW divert mode

Help
1

Hi everyone,

I want IPFW firewall and Suricata to work together. Below is how I do:

  1. Add a IPFW rule in divert mode, like this: ipfw add 100 divert 8000 ip from any to any

  2. Start suricata in inline mode,like this: suricata -c /usr/local/etc/suricata/suricata1.yaml -d 8000 -D

It works for me. But when I add a new firewall rule, I have to start a new suricata process. A suricata process will use about 100MB RAM. So I cannot create too many firewall rules.

Is there any way to solve this problem?

2

What version are you running and can you please paste your suricata yaml?

3

Thank you for your reply.

The Suricata version is 6.0.6

This attachment is my yaml file.
suricata_zg1.yaml (66.5 KB)