Suricata and vlans
-
Hi,
On my pfsense box (hyperv vm) I have installed suricata on the lan interface. Suricata is dropping traffic like it should however I also have a guest network which im running on a vlan.
When I assign the guest vlan to my lan interface suricata stops blocking/working. Im guessing it is because pfsense now has 2 interfaces assigned as 1 and suricata cant seperate them correctly, or only sniffs 1 of the 2 interfaces.
I read about someone who also noticed suricata stopped working properly and he set the mtu of the suricata/lan interface from 1500 to 1502 and this solved it for him. I dont know what im doing with mtu sizes so I would like to know how this could negatively impact traffic flow? Will this cause congestion? Dropped packets ?
Anyone else who noticed ? How did you resolve it ?
Thanks!
-
Hi,
On my pfsense box (hyperv vm) I have installed suricata on the lan interface. Suricata is dropping traffic like it should however I also have a guest network which im running on a vlan.
When I assign the guest vlan to my lan interface suricata stops blocking/working. Im guessing it is because pfsense now has 2 interfaces assigned as 1 and suricata cant seperate them correctly, or only sniffs 1 of the 2 interfaces.
I read about someone who also noticed suricata stopped working properly and he set the mtu of the suricata/lan interface from 1500 to 1502 and this solved it for him. I dont know what im doing with mtu sizes so I would like to know how this could negatively impact traffic flow? Will this cause congestion? Dropped packets ?
Anyone else who noticed ? How did you resolve it ?
Thanks!
Make sure you have the latest version of the Suricata package. If you are using Legacy Mode blocking, then you can increase the new snaplen parameter on the INTERFACE SETTINGS tab for the Suricata interface. It defaults to 1518, but sometimes VLAN tagging operations need a larger snap length from the pcap library in order to process VLANs.
Unfortunately, if you are using Inline IPS Mode, then a limitation within the Suricata binary makes using a non-default snaplen value impossible and you are stuck with the 1516 value. This is sometimes not large enough for VLANs. Additionally, Inline IPS Mode uses the netmap API and there may be some capatibility issues with netmap and VLANs in FreeBSD. I know the traffic shaper does not support netmap at the moment.
Bill
