Suricata and VirtIO

[gerby123]

Has anyone had any luck using suricata inline mode with virtio adapters? Currently have a virtualized environment running on KVM, guests are supplied virtio adapters connected to openvswitch which in turn connects to the physical interfaces; I'm assuming I'd need to rearchitect this with VALE and netmap to make suricata work in inline mode?

[boobletins]

@gerby123 said in Suricata and VirtIO:

VALE

Are you still running Suricata on a virtualized pfsense guest? Or are you asking about Suricata in Linux?

[gerby123]

Correct, the hypervisor is KVM but suricata is running in a PFSense guest.

[boobletins]

I don't have any experience with KVM/vertio, but I run pfSense in VMs (ESXi) using Bro and Suricata without an issue. This includes the use of virtual switches and etc

Can you not select a virtualized driver in KVM?

If you can't what driver is it using and what issue are you running into with using netmap on that interface?

[gerby123]

The issue I encounter seems related to others who have tried to run inline mode without netmap support; traffic passes for a brief period of time and then all traffic flow stops.

[gerby123]

This post is deleted!