I am working xdp_filter with suricata. I added rule about to drop icmp packets. This is af-packet section in suricata.yaml:
- interface: wlp0s20f3
#Number of receive threads. “auto” uses the number of cores
#Default clusterid. AF_PACKET will load balance packets based on flow.
When I started ping to 184.108.40.206 suricata can not drop icmp packets. Any help would be great!
Any error during Suricata start? What does the filter bpf do actually?
I didn’t face any error message during Suricata start. I checked logs it seem fine.
xdp_filter aims “XDP bypass allows Suricata to tell the kernel that packets for some flows have to be dropped via the XDP mechanism. This is an early drop that occurs before the datagram reaches the Linux kernel network stack.”
What version are you running?
How does your suricata.yaml look like?
How do you start suricata?
This is Suricata version 7.0.0-rc1-dev (4c7ca2c36 2022-12-22)
/usr/bin/suricata -c /home/ozgurkeskin/Projects/suricata/suricata.yaml --pidfile /var/run/suricata.pid --af-packet=wlp0s20f3 -vvv
And I attached suricata.yaml.
suricata.yaml (79.7 KB)
Did you update the
xdp_filter.bpf file or did you use a shipped one?
I used shipped one but I have to update maps declaration.Here is the link about problem.