Suricata and VirtIO



  • Has anyone had any luck using suricata inline mode with virtio adapters? Currently have a virtualized environment running on KVM, guests are supplied virtio adapters connected to openvswitch which in turn connects to the physical interfaces; I'm assuming I'd need to rearchitect this with VALE and netmap to make suricata work in inline mode?



  • @gerby123 said in Suricata and VirtIO:

    VALE

    Are you still running Suricata on a virtualized pfsense guest? Or are you asking about Suricata in Linux?



  • Correct, the hypervisor is KVM but suricata is running in a PFSense guest.



  • I don't have any experience with KVM/vertio, but I run pfSense in VMs (ESXi) using Bro and Suricata without an issue. This includes the use of virtual switches and etc

    Can you not select a virtualized driver in KVM?

    If you can't what driver is it using and what issue are you running into with using netmap on that interface?



  • The issue I encounter seems related to others who have tried to run inline mode without netmap support; traffic passes for a brief period of time and then all traffic flow stops.