Xdp_filter - suricata

Hi everyone,
I am working xdp_filter with suricata. I added rule about to drop icmp packets. This is af-packet section in suricata.yaml:

  • interface: wlp0s20f3
    #Number of receive threads. “auto” uses the number of cores
    #threads: auto
    #Default clusterid. AF_PACKET will load balance packets based on flow.
    cluster-id: 99
    cluster-type: cluster_cpu
    defrag: yes
    xdp-mode: soft
    xdp-filter-file: /home/ozgurkeskin/Projects/suricata/ebpf/xdp_filter.bpf
    xdp-cpu-redirect: [“all”]
    bypass: yes
    use-mmap: yes
    ring-size: 200000

When I started ping to suricata can not drop icmp packets. Any help would be great!
Best regards,

Any error during Suricata start? What does the filter bpf do actually?

Hi Peter,
I didn’t face any error message during Suricata start. I checked logs it seem fine.
xdp_filter aims “XDP bypass allows Suricata to tell the kernel that packets for some flows have to be dropped via the XDP mechanism. This is an early drop that occurs before the datagram reaches the Linux kernel network stack.”

What version are you running?
How does your suricata.yaml look like?
How do you start suricata?

Hi Andreas,
This is Suricata version 7.0.0-rc1-dev (4c7ca2c36 2022-12-22)
Run command
/usr/bin/suricata -c /home/ozgurkeskin/Projects/suricata/suricata.yaml --pidfile /var/run/suricata.pid --af-packet=wlp0s20f3 -vvv
And I attached suricata.yaml.
suricata.yaml (79.7 KB)

Did you update the xdp_filter.bpf file or did you use a shipped one?

I used shipped one but I have to update maps declaration.Here is the link about problem.