@Wolf666:
@bmeeks:
@mais_um:
Hi
Working file but Suricata still doesn't support PPPoE interfaces yet.
Correct. PPPoE support is a limitation within the Suricata binary itself and will require a patch. It is actually not supported on any FreeBSD derivative at this point (by Suricata, I mean). I plan to look into what it would take to create the required patch and then port it upstream into the Suricata source code tree.
Bill
Hi Bill,
is it confirmed that the following changes make Suricata works with PPPoE?
suricata.yaml:
pcap:
- interface: physical interface (ie. em0, igb0 etc etc)
checksum-checks: auto
promisc: yes
Thanks
No, this is not an officially sanctioned fix. While Suricata will then not complain, it can still get confused by the PPPoE frame header that will be present. It will work sort of, but not 100% correctly. What this does is tell Suricata to treat the PPPoE data link as a physical Ethernet interface. Physical Ethernet interfaces are not expected to contain PPPoE frame headers, so they can confuse Suricata.
Bill