Suricata netmap_transmit error
-
Hey,
I have been running pfSense+Snort within ESXi without a hiccup an Intel NIC is passed through directly via VT-d. Recently, I decided to give Suricata another go. I cloned the current setup, and deployed it under a different name. I removed Snort and installed Suricata. Spent the next few days configuring it in IPS Inline mode utilising Hyperscan. It has been running flawless for the past few weeks.
My network setup as follows:
Three VLANs:
Management
Secure Line (oVPN)
VM (Unused)Three Physical:
Untagged LAN
WiFi
WANSuricata Listening on:
WAN
LAN
WIFIThe issue I am currently facing is that yesturday, I was unable to obtain a DHCP lease from Management, nor Secure Line. I gave the box a reset and had brief access. However, the console was found to be full of the following errors:
If I set a Static IP on the management vlan, I am able to communicate with the ESXi interface, and other hosts. However, I am unable to communicate with pfSense interface.
So far, I have been able to remotely dial in and access the interface. I found that if I disabled suricata on the LAN interface, things would return back to normal… So at this current time I have suricata only listening to the WAN interface, while the LAN and WiFi interface remain disabled.
Anyone have any pointers as to what has caused these issues to start, and how do I go about rectifying it?
Kindest Regards
HC -
It actually has nothing to do with Suricata and more to do with FreeBSD kernel and the NIC driver. I just recently experience the same issue and have submitted a bug report to FreeBSD…see here. https://forum.pfsense.org/index.php?topic=144538.0
After researching, it seems that the dual Intel NIC is not natively supported per here: https://www.unix.com/man-page/freebsd/4/netmap/