Please include the following information with your help request:
Suricata version 8.0.0
Operating system and/or Linux distribution ubuntu 23.10 , kernel 6.5
How you installed Suricata (from source, packages, something else)
by repo
hello ,
i’m on vmware with a virtual machine 16.x
why the af-packet paragraph needs two interface like this :
af-packet:
- interface: ens33
threads: 8
defrag: yes
cluster-type: cluster_flow
cluster-id: 98
copy-mode: ips
copy-iface: ens37
buffer-size: 64535
use-mmap: yes
- interface: ens37
threads: 8
cluster-id: 97
defrag: yes
cluster-type: cluster_flow
copy-mode: ips
copy-iface: ens33
buffer-size: 64535
use-mmap: yes
it’s recommended by AI like claude sonnet 3.5 , but i don’t understand why . and the second interface, write liked - interface
, and and not commented on in the part :
af-packet:
- interface: ens33
threads: 8
defrag: yes
cluster-type: cluster_flow
cluster-id: 98
copy-mode: ips
copy-iface: ens37
buffer-size: 64535
use-mmap: yes
- interface: ens37
threads: 8
cluster-id: 97
defrag: yes
cluster-type: cluster_flow
copy-mode: ips
copy-iface: ens33
buffer-size: 64535
use-mmap: yes
could you help me ?
Cordially
ah yes ! there is a part for incoming traffic and the other for outgoing traffic! as much for me
lukashino
(Lukas Sismis)
July 2, 2024, 8:22am
3
yes, but to be more specific, each entry is for receiving traffic, each node is there in case you want to configure your interfaces differently.
Then copy-iface of the given interface says on what interface the traffic should be transmitted from when it is received.
So the traffic flows in both directions:
→ ens33 → ens37 →
and
← ens33 ← ens37 ←
So,
What interface is for entry and what interface in for sending ?
Why do you suggest there are two directions ?
Regards
lukashino
(Lukas Sismis)
July 2, 2024, 11:50am
6
What interface is for entry
both
and what interface in for sending ?
both
Why do you suggest there are two directions ?
Packets are received by one interface and are transmitted by the other interface. That works bidirectionally.
vjulien
(Victor Julien)
July 2, 2024, 1:30pm
7
Keep in mind that you only need 2 interface for IPS mode. If you just want to monitor traffic from one interface, one is enough.
how it is possible ??
if i write this :
af-packet:
- interface: ens33
threads: 8
defrag: yes
cluster-type: cluster_flow
cluster-id: 98
copy-mode: ips
buffer-size: 64535
use-mmap: yes
it will be correct ?
resgards
lukashino
(Lukas Sismis)
July 3, 2024, 8:45pm
9
We have no idea what you are trying to achieve but if you change copy-mode to ids so:
af-packet:
- interface: ens33
threads: 8
defrag: yes
cluster-type: cluster_flow
cluster-id: 98
copy-mode: ids
buffer-size: 64535
use-mmap: yes
then yes, it looks like a valid configuration
No !!
Julien Victor said ,I could run suricata with One interface !!! Did he lie ??
Do you want to run it in IDS or IPS mode?
ah yes! I forgot the subtlety!
I want the ips mode !
Regards
alexandre marillesse:
I want the ips mode !
In that case you want to use two interfaces, see details described in 15. Setting up IPS/inline for Linux — Suricata 8.0.0-dev documentation unless you want to do it via netfilter nfqueue, see 15. Setting up IPS/inline for Linux — Suricata 8.0.0-dev documentation
1 Like
hi ,
i want to install suricata in mode ips on a virtual private server, for a web hosting
but it seems that there is only a network interface.
AI Large language model say me that I can set the intrusion prevention system mode with nfqueue mode, do you agree ?
Cordially
Alexandre
M
Instead of asking some AI you should follow the documentation I previously linked which explains the runmode with NFQUEUE.