0 byte packet - Suricata alerts
-
I recently swapped my realtek for a dual port intel nic and started receiving all of these suricata alerts:
suricata[47718]: [1:2200002:1] SURICATA IPv4 total length smaller than header size [Classification: (null)] [Priority: 3] [**] [Raw pkt: 00 01 5C 63 5E 46 00 15 17 D7 23 18 08 00 45 00 00 00 7F BA 40 0]
If you decode the packet, it shows total length of 0 bytes. The source mac is my nic and the destination is my comcast gateway according to arp. Can anyone tell me what is going on? I've got hundreds of these warnings filling up my logs.
-
I've disabled the hardware offloading and rebooted the firewall. I enabled those since I'm using em(4) NIC. It seems to have ceased for now, but I'll monitor it for a while. Is this what is referred to as flapping?
-
Well, after testing the options a few times, I am sad to report that the hardware offloading options with the intel pro/1000 pt is not working for me. The network appeared to function fine otherwise, but the amount of those 0 byte packets generated is unnerving. This is on a AMD kabini system, if it makes a difference.