Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Suricata floods the log with "invalid checksum"

    Scheduled Pinned Locked Moved IDS/IPS
    5 Posts 2 Posters 22.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      Koenig
      last edited by

      Just got suricata working but it floods the log with "suricata 5498 [1:2200075:2] SURICATA UDPv4 invalid checksum [Classification: Generic Protocol Command Decode] [Priority: 3] {UDP}"

      What to do about it?

      1 Reply Last reply Reply Quote 0
      • bmeeksB
        bmeeks
        last edited by

        @Koenig:

        Just got suricata working but it floods the log with "suricata 5498 [1:2200075:2] SURICATA UDPv4 invalid checksum [Classification: Generic Protocol Command Decode] [Priority: 3] {UDP}"

        What to do about it?

        Try toggling the Hardware Checksum Offloading feature under SYSTEM > NETWORKING > ADVANCED.  If that does not do it, you can simply disable that particular rule by either clicking the red X icon on the Alerts tab in the GID/SID column, or you can find and selectively disable that rule on the Rules tab for the interface.

        Bill

        1 Reply Last reply Reply Quote 0
        • K
          Koenig
          last edited by

          @bmeeks:

          @Koenig:

          Just got suricata working but it floods the log with "suricata 5498 [1:2200075:2] SURICATA UDPv4 invalid checksum [Classification: Generic Protocol Command Decode] [Priority: 3] {UDP}"

          What to do about it?

          Try toggling the Hardware Checksum Offloading feature under SYSTEM > NETWORKING > ADVANCED.  If that does not do it, you can simply disable that particular rule by either clicking the red X icon on the Alerts tab in the GID/SID column, or you can find and selectively disable that rule on the Rules tab for the interface.

          Bill

          I have Intel NIC's so the (QOTOM I5) hardware checksum should be working or shouldn't it?

          Waiting for an answer here I googled it, and from what I gather it is better to supress it for until I get into it more?

          I'm a total newbie when it comes to suricata.

          1 Reply Last reply Reply Quote 0
          • bmeeksB
            bmeeks
            last edited by

            @Koenig:

            @bmeeks:

            @Koenig:

            Just got suricata working but it floods the log with "suricata 5498 [1:2200075:2] SURICATA UDPv4 invalid checksum [Classification: Generic Protocol Command Decode] [Priority: 3] {UDP}"

            What to do about it?

            Try toggling the Hardware Checksum Offloading feature under SYSTEM > NETWORKING > ADVANCED.  If that does not do it, you can simply disable that particular rule by either clicking the red X icon on the Alerts tab in the GID/SID column, or you can find and selectively disable that rule on the Rules tab for the interface.

            Bill

            I have Intel NIC's so the (QOTOM I5) hardware checksum should be working or shouldn't it?

            Waiting for an answer here I googled it, and from what I gather it is better to supress it for until I get into it more?

            I'm a total newbie when it comes to suricata.

            See this thread from the official Suricata documentation Wiki for details:  http://suricata.readthedocs.io/en/latest/performance/packet-capture.html, but the short answer is you want hardware checksum offloading disabled as well as LRO (it is already off by default in pfSense).  Suricata uses PCAP for packet capture during Legacy Blocking Mode operation, and Netmap for Inline IPS Mode operation.  In both cases, hardware checksum offloading needs to be disabled.

            Bill

            1 Reply Last reply Reply Quote 1
            • K
              Koenig
              last edited by

              @bmeeks:

              @Koenig:

              @bmeeks:

              @Koenig:

              Just got suricata working but it floods the log with "suricata 5498 [1:2200075:2] SURICATA UDPv4 invalid checksum [Classification: Generic Protocol Command Decode] [Priority: 3] {UDP}"

              What to do about it?

              Try toggling the Hardware Checksum Offloading feature under SYSTEM > NETWORKING > ADVANCED.  If that does not do it, you can simply disable that particular rule by either clicking the red X icon on the Alerts tab in the GID/SID column, or you can find and selectively disable that rule on the Rules tab for the interface.

              Bill

              I have Intel NIC's so the (QOTOM I5) hardware checksum should be working or shouldn't it?

              Waiting for an answer here I googled it, and from what I gather it is better to supress it for until I get into it more?

              I'm a total newbie when it comes to suricata.

              See this thread from the official Suricata documentation Wiki for details:  http://suricata.readthedocs.io/en/latest/performance/packet-capture.html, but the short answer is you want hardware checksum offloading disabled as well as LRO (it is already off by default in pfSense).  Suricata uses PCAP for packet capture during Legacy Blocking Mode operation, and Netmap for Inline IPS Mode operation.  In both cases, hardware checksum offloading needs to be disabled.

              Bill

              Thank you!

              All disabled.

              1 Reply Last reply Reply Quote 0
              • First post
                Last post
              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.