Suricata 2.0.3 Package Preview

bmeeks

Has this issue been resolved?

I am also running a PPPoE Connection and trying to get Suricata configured but my logs are flooded with "SC_ERR_DATALINK_UNIMPLEMENTED" errors.

Suricata will not start automatically after a pfsense restart, is this by design or caused by these errors?

Regards,

No, not resolved and can't be really resolved until there is an upstream patch to Suricata so it recognizes the DLT_NULL data link type that FreeBSD assigns to PPPoE interfaces. This is a problem in the Suricata binary that comes from upstream.

You can make it partially work by hand-editing the suricata.yaml file and telling it the interface is an Ethernet physical link (by using the real physical NIC driver name), but you will still get occasional errors due to the PPPoE frame headers since Suricata does not expect to see them on a physical Ethernet interface. Also, I can't guarantee you that all the detection signatures will work properly. In short, this kind of hack is unsupported and you would be on your own.

If you have a PPPoE interface and want IDS/IPS on it, then you should use Snort instead of Suricata. The Snort binary fully supports the DLT_NULL data link type that FreeBSD uses.

Bill