Intel NIC I-226V

stephenw10

Well nothing specific since, as I say, I've not really poked at this. But I'd start here: https://man.freebsd.org/cgi/man.cgi?query=netmap

Bill can probably tell us if this is worth investigating.

Antibiotic

@stephenw10 FreeBSD man page too hard for me)))) I'm not IT pro)) Could some read our conversation and give some tips! I will wait

bmeeks

How many Suricata instances are you running and how many enabled rules on each instance?

Remove this setting:

sysctl net.bpf.zerocopy_enable=1

Ignore those notes at the end of the package install. They are coming from the default notes packaged from upstream and have no usefulness in pfSense.

Running Suricata, ntopng, and Crowdsec is asking a lot from this firewall.

Post back the output of this command:

ps -ax | grep suricata

I'm guessing you have multiple Suricata instances running on the same interface and thus are severely wasting CPU cycles doing duplicate work.

Antibiotic

@bmeeks 26057 - Ss 3:58.16 /usr/local/bin/suricata --netmap -D -c /usr/local/etc/suricata/suricata_12484_igc1/suricata.yaml --pidfile /var/run/suricata_igc112484.pid
27203 0 S+ 0:00.00 grep suricata

Antibiotic

@bmeeks I'm not sure , what you asking but running suricata on LAN only. Also have a on pfSense box 4th NIC's but working only 2 now ( one as WAN and second as LAN)

bmeeks

What rules do you have enabled?

Suricata should be able to obtain 1 Gigabit/sec performance using inline-IPS mode with most modern multicore CPUs and a decent multi-queue NIC. Perhaps your flavor of the I-226V NIC has an issue. How many netmap queues and slots show up from this command?

grep /var/log/dmesg.boot netmap

Antibiotic

@bmeeks Suricata in IPS Policy Selection Balanced
IPS Policy Mode Policy

Antibiotic

@bmeeks
grep /var/log/dmesg.boot netmap
grep: netmap: No such file or directory

bmeeks

@Antibiotic said in Intel NIC I-226V:

@bmeeks
grep /var/log/dmesg.boot netmap
grep: netmap: No such file or directory

I'm sorry. I had the terms reversed. Use this command:

grep netmap /var/log/dmesg.boot

Antibiotic

@bmeeks
igc0: netmap queues/slots: TX 4/1024, RX 4/1024
igc1: netmap queues/slots: TX 4/1024, RX 4/1024
igc2: netmap queues/slots: TX 4/1024, RX 4/1024
igc3: netmap queues/slots: TX 4/1024, RX 4/1024

bmeeks

You can try switching the runmode to workers on the INTERFACE SETTINGS tab in Suricata. Restart Suricata after making that change.

If that does not increase performance to where you want it, then you will just have to be content with using Legacy Blocking Mode and abandon Inline IPS Mode. There is really nothing else you can do.

Antibiotic

@bmeeks
runmode to workers set from beginning , so only option for legacy mode as understood ((((

Antibiotic

@bmeeks
Should I'm remove from sysctl netmap native mode option if suricata set to legacy mode or ntopng still can use this? I will try asking FreeBSD forum , could some tip give me regarding tuning netmap in native mode.

bmeeks

@Antibiotic said in Intel NIC I-226V:

@bmeeks
Should I'm remove from sysctl netmap native mode option if suricata set to legacy mode or ntopng still can use this? I will try asking FreeBSD forum , could some tip give me regarding tuning netmap in native mode.

ntopng does not use netmap at all in FreeBSD.

Suricata does not use netmap when operating in Legacy Blocking Mode. It uses libpcap instead. And when using netmap with Inline IPS Mode, Suricata will only allow you to select Inline mode if your NIC supports native operation. The GUI code will not allow you to choose netmap operation for a network adapter that requires emulated mode. Therefore, setting emulated mode or native mode is worthless in pfSense when configuring for Suricata.

Remove any customization you did with netmap tunables. They are not necessary and may actually do more harm than good in your situation.

Antibiotic

@bmeeks Ok thank's

Antibiotic

@Antibiotic Like understood from this conversation my NIC ( INTEL I-226V) have a problem with driver of netmap in FreeBSD . Is it correct?

Antibiotic

@Antibiotic The last question , can than to set Hardware Checksum Offloading ON back if suricata use legacy mode?

bmeeks

@Antibiotic said in Intel NIC I-226V:

@Antibiotic Like understood from this conversation my NIC ( INTEL I-226V) have a problem with driver of netmap in FreeBSD . Is it correct?

Perhaps. Hard to say without knowing the exact firmware revision and then doing research on that firmware against the current driver code in FreeBSD. Most all NICs these days in FreeBSD utilize the iflib abstraction layer.

I'm not a NIC hardware expert.

I takes a lot of processing power to get line rate inline IPS performance with a large rule set. You want an RSS-enabled kernel, a server class multi-queue NIC, and a very fast and high core count CPU. Plenty of Suricata users out there are getting 3 to 4 Gigabit/sec IPS performance, but they have server class hardware doing that without any other package running on the box. And these are also usually Linux-based firewalls.

bmeeks

@Antibiotic said in Intel NIC I-226V:

@Antibiotic The last question , can than to set Hardware Checksum Offloading ON back if suricata use legacy mode?

No!! That mode will confuse the detection engine. When using IDS/IPS, leave all hardware offloading features disabled.

Antibiotic

@bmeeks
Oh ok, out from home users in-line mode, i guess)))