Intel NIC I-226V

Antibiotic

@Antibiotic Like understood from this conversation my NIC ( INTEL I-226V) have a problem with driver of netmap in FreeBSD . Is it correct?

Antibiotic

@Antibiotic The last question , can than to set Hardware Checksum Offloading ON back if suricata use legacy mode?

bmeeks

@Antibiotic said in Intel NIC I-226V:

@Antibiotic Like understood from this conversation my NIC ( INTEL I-226V) have a problem with driver of netmap in FreeBSD . Is it correct?

Perhaps. Hard to say without knowing the exact firmware revision and then doing research on that firmware against the current driver code in FreeBSD. Most all NICs these days in FreeBSD utilize the iflib abstraction layer.

I'm not a NIC hardware expert.

I takes a lot of processing power to get line rate inline IPS performance with a large rule set. You want an RSS-enabled kernel, a server class multi-queue NIC, and a very fast and high core count CPU. Plenty of Suricata users out there are getting 3 to 4 Gigabit/sec IPS performance, but they have server class hardware doing that without any other package running on the box. And these are also usually Linux-based firewalls.

bmeeks

@Antibiotic said in Intel NIC I-226V:

@Antibiotic The last question , can than to set Hardware Checksum Offloading ON back if suricata use legacy mode?

No!! That mode will confuse the detection engine. When using IDS/IPS, leave all hardware offloading features disabled.

Antibiotic

@bmeeks
Oh ok, out from home users in-line mode, i guess)))

stephenw10

Well the fact you're not seeing the CPU cores pegged at 100% suggests there might be more available.

The testing you have done points towards igc/netmap but I'd want to see something more positive before making any conclusions. It wouldn't be the first time something seemingly unrelated came into play.

bmeeks

@Antibiotic said in Intel NIC I-226V:

@bmeeks
Oh ok, out from home users in-line mode, i guess)))

To be perfectly honest, Suricata has very limited usefulness at best in a home network. I am the creator of the package for pfSense, and I don't run it in my home network. I have not run an IDS/IPS in my home network for the last several years. And even when I did, it was only to collect some events in logs to aid me in debugging the package code or adding new features.

Suricata cannot see into encrypted traffic, and 90% or more of typical network traffic now is encrypted (HTTPS, SMTPS, POP3S, IMAPS, DoT, DoH, TLS, etc.). Suricata is totally blind to the payloads of these encrypted packets.

Much better security can be had by simply keeping internal hosts updated with the latest security hotfixes and running a good antivirus client on them along with just being careful what you click on as a user.

Antibiotic

@bmeeks I think also to uninstall of suricata at home and set Hardware Checksum Offloading ON back for traffic shaping!

stephenw10

You don't need checksum off loading to run traffic shaping.

Antibiotic

@stephenw10 Do you mean not required, but can still keep ON or mandatory to keep OFF for better result?

Antibiotic

@Antibiotic Because have tested now with all 3 options on (Hardware Checksum Offloading, Hardware TCP Segmentation Offloading, Hardware Large Receive Offloading) AND RESULT IS A+ for bufferbloat.

stephenw10

I'm saying that hardware off-loading should make no difference to traffic shaping or buffer bloat.

Antibiotic

@stephenw10 Ah well understood)))

Antibiotic

@stephenw10 What is more effective ALTQ Scheduler Types or Limiters? Like understood from pfesense docs, if NIC support ALTQ better use this insteed of limiters. But my NIC support ALTQ and anyway best result with limiters have?

Antibiotic

@stephenw10 I', suspecting that this tests for bufferbloat online , like a marketing trick. If you use FQ-Codel , result is good. But lets say traffic shaping with ALTQ scheduler result is worse.

stephenw10

Either can work though if you want to address buffer bloat specifically I would use Limiters as shown here:
https://docs.netgate.com/pfsense/en/latest/recipes/codel-limiters.html