Intel NIC I-226V
-
What rules do you have enabled?
Suricata should be able to obtain 1 Gigabit/sec performance using inline-IPS mode with most modern multicore CPUs and a decent multi-queue NIC. Perhaps your flavor of the I-226V NIC has an issue. How many netmap queues and slots show up from this command?
grep /var/log/dmesg.boot netmap -
@bmeeks Suricata in IPS Policy Selection Balanced
IPS Policy Mode Policy -
@bmeeks
grep /var/log/dmesg.boot netmap
grep: netmap: No such file or directory -
@Antibiotic said in Intel NIC I-226V:
@bmeeks
grep /var/log/dmesg.boot netmap
grep: netmap: No such file or directoryI'm sorry. I had the terms reversed. Use this command:
grep netmap /var/log/dmesg.boot -
@bmeeks
igc0: netmap queues/slots: TX 4/1024, RX 4/1024
igc1: netmap queues/slots: TX 4/1024, RX 4/1024
igc2: netmap queues/slots: TX 4/1024, RX 4/1024
igc3: netmap queues/slots: TX 4/1024, RX 4/1024 -
You can try switching the runmode to
workerson the INTERFACE SETTINGS tab in Suricata. Restart Suricata after making that change.If that does not increase performance to where you want it, then you will just have to be content with using Legacy Blocking Mode and abandon Inline IPS Mode. There is really nothing else you can do.
-
@bmeeks
runmode to workers set from beginning , so only option for legacy mode as understood (((( -
@bmeeks
Should I'm remove from sysctl netmap native mode option if suricata set to legacy mode or ntopng still can use this? I will try asking FreeBSD forum , could some tip give me regarding tuning netmap in native mode. -
@Antibiotic said in Intel NIC I-226V:
@bmeeks
Should I'm remove from sysctl netmap native mode option if suricata set to legacy mode or ntopng still can use this? I will try asking FreeBSD forum , could some tip give me regarding tuning netmap in native mode.ntopng does not use netmap at all in FreeBSD.
Suricata does not use netmap when operating in Legacy Blocking Mode. It uses
libpcapinstead. And when using netmap with Inline IPS Mode, Suricata will only allow you to select Inline mode if your NIC supports native operation. The GUI code will not allow you to choose netmap operation for a network adapter that requires emulated mode. Therefore, setting emulated mode or native mode is worthless in pfSense when configuring for Suricata.Remove any customization you did with netmap tunables. They are not necessary and may actually do more harm than good in your situation.
-
@bmeeks Ok thank's
-
@Antibiotic Like understood from this conversation my NIC ( INTEL I-226V) have a problem with driver of netmap in FreeBSD . Is it correct?
pfSense plus 24.11 on Topton mini PC
CPU: Intel N100
NIC: Intel i-226v 4 pcs
RAM : 16 GB DDR5
Disk: 128 GB NVMe
Brgds, Archi -
@Antibiotic The last question , can than to set Hardware Checksum Offloading ON back if suricata use legacy mode?
pfSense plus 24.11 on Topton mini PC
CPU: Intel N100
NIC: Intel i-226v 4 pcs
RAM : 16 GB DDR5
Disk: 128 GB NVMe
Brgds, Archi -
@Antibiotic said in Intel NIC I-226V:
@Antibiotic Like understood from this conversation my NIC ( INTEL I-226V) have a problem with driver of netmap in FreeBSD . Is it correct?
Perhaps. Hard to say without knowing the exact firmware revision and then doing research on that firmware against the current driver code in FreeBSD. Most all NICs these days in FreeBSD utilize the
iflibabstraction layer.I'm not a NIC hardware expert.
I takes a lot of processing power to get line rate inline IPS performance with a large rule set. You want an RSS-enabled kernel, a server class multi-queue NIC, and a very fast and high core count CPU. Plenty of Suricata users out there are getting 3 to 4 Gigabit/sec IPS performance, but they have server class hardware doing that without any other package running on the box. And these are also usually Linux-based firewalls.
-
@Antibiotic said in Intel NIC I-226V:
@Antibiotic The last question , can than to set Hardware Checksum Offloading ON back if suricata use legacy mode?
No!! That mode will confuse the detection engine. When using IDS/IPS, leave all hardware offloading features disabled.
-
@bmeeks
Oh ok, out from home users in-line mode, i guess)))pfSense plus 24.11 on Topton mini PC
CPU: Intel N100
NIC: Intel i-226v 4 pcs
RAM : 16 GB DDR5
Disk: 128 GB NVMe
Brgds, Archi -
Well the fact you're not seeing the CPU cores pegged at 100% suggests there might be more available.
The testing you have done points towards igc/netmap but I'd want to see something more positive before making any conclusions. It wouldn't be the first time something seemingly unrelated came into play.
-
@Antibiotic said in Intel NIC I-226V:
@bmeeks
Oh ok, out from home users in-line mode, i guess)))To be perfectly honest, Suricata has very limited usefulness at best in a home network. I am the creator of the package for pfSense, and I don't run it in my home network. I have not run an IDS/IPS in my home network for the last several years. And even when I did, it was only to collect some events in logs to aid me in debugging the package code or adding new features.
Suricata cannot see into encrypted traffic, and 90% or more of typical network traffic now is encrypted (HTTPS, SMTPS, POP3S, IMAPS, DoT, DoH, TLS, etc.). Suricata is totally blind to the payloads of these encrypted packets.
Much better security can be had by simply keeping internal hosts updated with the latest security hotfixes and running a good antivirus client on them along with just being careful what you click on as a user.
-
@bmeeks I think also to uninstall of suricata at home and set Hardware Checksum Offloading ON back for traffic shaping!
-
You don't need checksum off loading to run traffic shaping.
-
@stephenw10 Do you mean not required, but can still keep ON or mandatory to keep OFF for better result?
