Suricata



  • I am receiving numerous messages "SURICATA STREAM Packet with invalid timestamp". What are these messages? Are they valid alerts? Should I suppress them?



  • This could be caused by checksum calculation offloading.  Here is a post about the issue on VMware using the VMXNET3 drivers.

    http://everythingshouldbevirtual.com/suricata-idsips-vmxnet3

    Bill



  • FOlks, I ws seeing this same exact problem running on an e1000 adapter as well.  I found disabling hardware checksumming in PFSENSE under ->SYSTEM->ADVANCED->NETWORKING stopping all my stream errors.  Its too bad this is an able to be set on an interface by interface basis, as I really only need this on the WAN inetrface, but pfsense is running on beefy hardware and so far everything seems fine performance wise.

    This was a really tricky error to find, so I wanted to make sure others that try and run suricata on a virtualized pfsense have an easier time than me fixing it.

    Thanks
    Mike