Suricata
-
I am receiving numerous messages "SURICATA STREAM Packet with invalid timestamp". What are these messages? Are they valid alerts? Should I suppress them?
-
This could be caused by checksum calculation offloading. Here is a post about the issue on VMware using the VMXNET3 drivers.
http://everythingshouldbevirtual.com/suricata-idsips-vmxnet3
Bill
-
FOlks, I ws seeing this same exact problem running on an e1000 adapter as well. I found disabling hardware checksumming in PFSENSE under ->SYSTEM->ADVANCED->NETWORKING stopping all my stream errors. Its too bad this is an able to be set on an interface by interface basis, as I really only need this on the WAN inetrface, but pfsense is running on beefy hardware and so far everything seems fine performance wise.
This was a really tricky error to find, so I wanted to make sure others that try and run suricata on a virtualized pfsense have an easier time than me fixing it.
Thanks
Mike
