Intel NIC I-226V
-
You can try switching the runmode to
workerson the INTERFACE SETTINGS tab in Suricata. Restart Suricata after making that change.If that does not increase performance to where you want it, then you will just have to be content with using Legacy Blocking Mode and abandon Inline IPS Mode. There is really nothing else you can do.
-
@bmeeks
runmode to workers set from beginning , so only option for legacy mode as understood (((( -
@bmeeks
Should I'm remove from sysctl netmap native mode option if suricata set to legacy mode or ntopng still can use this? I will try asking FreeBSD forum , could some tip give me regarding tuning netmap in native mode. -
@Antibiotic said in Intel NIC I-226V:
@bmeeks
Should I'm remove from sysctl netmap native mode option if suricata set to legacy mode or ntopng still can use this? I will try asking FreeBSD forum , could some tip give me regarding tuning netmap in native mode.ntopng does not use netmap at all in FreeBSD.
Suricata does not use netmap when operating in Legacy Blocking Mode. It uses
libpcapinstead. And when using netmap with Inline IPS Mode, Suricata will only allow you to select Inline mode if your NIC supports native operation. The GUI code will not allow you to choose netmap operation for a network adapter that requires emulated mode. Therefore, setting emulated mode or native mode is worthless in pfSense when configuring for Suricata.Remove any customization you did with netmap tunables. They are not necessary and may actually do more harm than good in your situation.
-
@bmeeks Ok thank's
-
@Antibiotic Like understood from this conversation my NIC ( INTEL I-226V) have a problem with driver of netmap in FreeBSD . Is it correct?
pfSense plus 24.11 on Topton mini PC
CPU: Intel N100
NIC: Intel i-226v 4 pcs
RAM : 16 GB DDR5
Disk: 128 GB NVMe
Brgds, Archi -
@Antibiotic The last question , can than to set Hardware Checksum Offloading ON back if suricata use legacy mode?
pfSense plus 24.11 on Topton mini PC
CPU: Intel N100
NIC: Intel i-226v 4 pcs
RAM : 16 GB DDR5
Disk: 128 GB NVMe
Brgds, Archi -
@Antibiotic said in Intel NIC I-226V:
@Antibiotic Like understood from this conversation my NIC ( INTEL I-226V) have a problem with driver of netmap in FreeBSD . Is it correct?
Perhaps. Hard to say without knowing the exact firmware revision and then doing research on that firmware against the current driver code in FreeBSD. Most all NICs these days in FreeBSD utilize the
iflibabstraction layer.I'm not a NIC hardware expert.
I takes a lot of processing power to get line rate inline IPS performance with a large rule set. You want an RSS-enabled kernel, a server class multi-queue NIC, and a very fast and high core count CPU. Plenty of Suricata users out there are getting 3 to 4 Gigabit/sec IPS performance, but they have server class hardware doing that without any other package running on the box. And these are also usually Linux-based firewalls.
-
@Antibiotic said in Intel NIC I-226V:
@Antibiotic The last question , can than to set Hardware Checksum Offloading ON back if suricata use legacy mode?
No!! That mode will confuse the detection engine. When using IDS/IPS, leave all hardware offloading features disabled.
-
@bmeeks
Oh ok, out from home users in-line mode, i guess)))pfSense plus 24.11 on Topton mini PC
CPU: Intel N100
NIC: Intel i-226v 4 pcs
RAM : 16 GB DDR5
Disk: 128 GB NVMe
Brgds, Archi -
Well the fact you're not seeing the CPU cores pegged at 100% suggests there might be more available.
The testing you have done points towards igc/netmap but I'd want to see something more positive before making any conclusions. It wouldn't be the first time something seemingly unrelated came into play.
-
@Antibiotic said in Intel NIC I-226V:
@bmeeks
Oh ok, out from home users in-line mode, i guess)))To be perfectly honest, Suricata has very limited usefulness at best in a home network. I am the creator of the package for pfSense, and I don't run it in my home network. I have not run an IDS/IPS in my home network for the last several years. And even when I did, it was only to collect some events in logs to aid me in debugging the package code or adding new features.
Suricata cannot see into encrypted traffic, and 90% or more of typical network traffic now is encrypted (HTTPS, SMTPS, POP3S, IMAPS, DoT, DoH, TLS, etc.). Suricata is totally blind to the payloads of these encrypted packets.
Much better security can be had by simply keeping internal hosts updated with the latest security hotfixes and running a good antivirus client on them along with just being careful what you click on as a user.
-
@bmeeks I think also to uninstall of suricata at home and set Hardware Checksum Offloading ON back for traffic shaping!
-
You don't need checksum off loading to run traffic shaping.
-
@stephenw10 Do you mean not required, but can still keep ON or mandatory to keep OFF for better result?
-
@Antibiotic Because have tested now with all 3 options on (Hardware Checksum Offloading, Hardware TCP Segmentation Offloading, Hardware Large Receive Offloading) AND RESULT IS A+ for bufferbloat.
-
I'm saying that hardware off-loading should make no difference to traffic shaping or buffer bloat.
-
@stephenw10 Ah well understood)))
-
@stephenw10 What is more effective ALTQ Scheduler Types or Limiters? Like understood from pfesense docs, if NIC support ALTQ better use this insteed of limiters. But my NIC support ALTQ and anyway best result with limiters have?
-
@stephenw10 I', suspecting that this tests for bufferbloat online , like a marketing trick. If you use FQ-Codel , result is good. But lets say traffic shaping with ALTQ scheduler result is worse.
