Intel NIC I-226V
-
@stephenw10 During suricata installation at the end was this tip and I did)))
-
Oh, in the install log? Ok well I would definitely try disabling that then. Almost all users would not set that.
-
@Antibiotic Unfortunately, sysctl dev.netmap.admode=1 doesn't help at all. So the option only to use in legacy mode?
-
But it didn't break traffic?
That implies igc is running netmap in native mode but for some reason the performance isn't as expected. That's not something I've ever poked at in any depth. There may be some tuning option there though.
-
@stephenw10 I'm left netmap in native mode and remove from sysctl net.bpf.zerocopy_enable=1. The speed the same as not to be normal. Its not a break traffic. Can you please give me some links for tuning netmap in native mode? BTW after reboot all this services ( suricata, crowdsec, ntopng and pfblockerng need to start manually something wrong)
-
Well nothing specific since, as I say, I've not really poked at this. But I'd start here: https://man.freebsd.org/cgi/man.cgi?query=netmap
Bill can probably tell us if this is worth investigating.
-
@stephenw10 FreeBSD man page too hard for me)))) I'm not IT pro)) Could some read our conversation and give some tips! I will wait
-
How many Suricata instances are you running and how many enabled rules on each instance?
Remove this setting:
sysctl net.bpf.zerocopy_enable=1Ignore those notes at the end of the package install. They are coming from the default notes packaged from upstream and have no usefulness in pfSense.
Running Suricata, ntopng, and Crowdsec is asking a lot from this firewall.
Post back the output of this command:
ps -ax | grep suricataI'm guessing you have multiple Suricata instances running on the same interface and thus are severely wasting CPU cycles doing duplicate work.
-
@bmeeks 26057 - Ss 3:58.16 /usr/local/bin/suricata --netmap -D -c /usr/local/etc/suricata/suricata_12484_igc1/suricata.yaml --pidfile /var/run/suricata_igc112484.pid
27203 0 S+ 0:00.00 grep suricata -
@bmeeks I'm not sure , what you asking but running suricata on LAN only. Also have a on pfSense box 4th NIC's but working only 2 now ( one as WAN and second as LAN)
-
What rules do you have enabled?
Suricata should be able to obtain 1 Gigabit/sec performance using inline-IPS mode with most modern multicore CPUs and a decent multi-queue NIC. Perhaps your flavor of the I-226V NIC has an issue. How many netmap queues and slots show up from this command?
grep /var/log/dmesg.boot netmap -
@bmeeks Suricata in IPS Policy Selection Balanced
IPS Policy Mode Policy -
@bmeeks
grep /var/log/dmesg.boot netmap
grep: netmap: No such file or directory -
@Antibiotic said in Intel NIC I-226V:
@bmeeks
grep /var/log/dmesg.boot netmap
grep: netmap: No such file or directoryI'm sorry. I had the terms reversed. Use this command:
grep netmap /var/log/dmesg.boot -
@bmeeks
igc0: netmap queues/slots: TX 4/1024, RX 4/1024
igc1: netmap queues/slots: TX 4/1024, RX 4/1024
igc2: netmap queues/slots: TX 4/1024, RX 4/1024
igc3: netmap queues/slots: TX 4/1024, RX 4/1024 -
You can try switching the runmode to
workerson the INTERFACE SETTINGS tab in Suricata. Restart Suricata after making that change.If that does not increase performance to where you want it, then you will just have to be content with using Legacy Blocking Mode and abandon Inline IPS Mode. There is really nothing else you can do.
-
@bmeeks
runmode to workers set from beginning , so only option for legacy mode as understood (((( -
@bmeeks
Should I'm remove from sysctl netmap native mode option if suricata set to legacy mode or ntopng still can use this? I will try asking FreeBSD forum , could some tip give me regarding tuning netmap in native mode. -
@Antibiotic said in Intel NIC I-226V:
@bmeeks
Should I'm remove from sysctl netmap native mode option if suricata set to legacy mode or ntopng still can use this? I will try asking FreeBSD forum , could some tip give me regarding tuning netmap in native mode.ntopng does not use netmap at all in FreeBSD.
Suricata does not use netmap when operating in Legacy Blocking Mode. It uses
libpcapinstead. And when using netmap with Inline IPS Mode, Suricata will only allow you to select Inline mode if your NIC supports native operation. The GUI code will not allow you to choose netmap operation for a network adapter that requires emulated mode. Therefore, setting emulated mode or native mode is worthless in pfSense when configuring for Suricata.Remove any customization you did with netmap tunables. They are not necessary and may actually do more harm than good in your situation.
-
@bmeeks Ok thank's
