8x igb Intel(R) I211 / checksums - enable or disable / suricata

stephenw10

By unchecking the box in Sys > Adv > Networking you are enabling checksum offloading globally. So whenever an interface is configured it will be set as enabled. Probably igb1 linked/unlinked after that shellcmd ran so it was enabled again.

4o4rh

@stephenw10 so actually, the command should be then;
<shellcmd>ifconfig igb0 -tso4 -tso6 -lro -vlanhwtso</shellcmd>
as it is only tso and lro that we need to turn off right

but in any case, the system is doing it's own thing.

If i enter the below, some turn rxc/txc on and some off, but if i run the command from the shell it works.

<shellcmd>ifconfig igb0 rxcsum txcsum -tso4 -tso6 -lro rxcsum6 txcsum6 -vlanhwtso</shellcmd>
<shellcmd>ifconfig igb1 rxcsum txcsum -tso4 -tso6 -lro rxcsum6 txcsum6 -vlanhwtso</shellcmd>
<shellcmd>ifconfig igb2 rxcsum txcsum -tso4 -tso6 -lro rxcsum6 txcsum6 -vlanhwtso</shellcmd>
<shellcmd>ifconfig igb3 rxcsum txcsum -tso4 -tso6 -lro rxcsum6 txcsum6 -vlanhwtso</shellcmd>
<shellcmd>ifconfig igb4 rxcsum txcsum -tso4 -tso6 -lro rxcsum6 txcsum6 -vlanhwtso</shellcmd>
<shellcmd>ifconfig igb5 rxcsum txcsum -tso4 -tso6 -lro rxcsum6 txcsum6 -vlanhwtso</shellcmd>
<shellcmd>ifconfig igb6 rxcsum txcsum -tso4 -tso6 -lro rxcsum6 txcsum6 -vlanhwtso</shellcmd>
<shellcmd>ifconfig igb7 rxcsum txcsum -tso4 -tso6 -lro rxcsum6 txcsum6 -vlanhwtso</shellcmd>

stephenw10

Since you don't have igb0 assigned dircetly it doesn't make any difference there. The ppp traffic using it cannot be off-loaded. Part of the reason PPPoE is always slower.

You can use the afterfilterchnageshellcmd type to apply settings when an interface is relinked if you need to.
You probably don't need to do any of that though.

4o4rh

@stephenw10 i thought you meant

took down my system ;-)

I can't find any document on setting that value

stephenw10

It will run the command everytime the filter is reloaded.

It may have created a loop if running that command triggers the filter to reload.

4o4rh

@stephenw10 i mean i edited the config.xml which crashed the machine. I didn't realize there was a shellcmd package to install

stephenw10

Ah, yes, much safer to use the package!

4o4rh

@stephenw10 except it only allows one afterfiltercmd.

p.s. very weird. after adding the command for igb0 in the afterfilter all igb interfaces now have the desired settings

4o4rh

@stephenw10 i thought this was fixed, but it seems the suricata package was not updated properly.
once i reinstalled the suricata package, the problem of different settings per igb is back.

using the aftersfilterchangeshellcmd does work, for the specific interface but you can only do one.

stephenw10

Use a script in the shellcmd that runs on whatever interfaces you need.