Project

General

Profile

Bug #6690

SURICATA IPS Issue - Kills VLANS & Traffic Shaper

Added by Steven Kreitzer 9 months ago. Updated 8 days ago.

Status:
New
Priority:
Normal
Category:
Suricata
Target version:
Start date:
08/10/2016
Due date:
% Done:

0%

Affected version:
2.3.x
Affected Architecture:
All

Description

Strips 802.1q tagged traffic from an interface when running inline IPS mode.
Traffic shapper no longer works as one single interface can use up the whole upstream bandwidth.

History

#1 Updated by Jim Thompson 9 months ago

  • Category set to Suricata
  • Assignee set to Luiz Otavio O Souza
  • Target version set to 2.4.0
  • Affected version set to 2.3.x
  • Affected Architecture set to All

#2 Updated by Sandeep K V 8 months ago

Hi Steven Kreitzer and Jim Thompson isn't this the expected way the IPS has to work?

#3 Updated by Steven Kreitzer 8 months ago

Sandeep K V wrote:

Hi Steven Kreitzer and Jim Thompson isn't this the expected way the IPS has to work?

No, and it definitely shouldn't be stripping 802.1q traffic. I know it uses netcap and it may be an error on netcaps side.

#4 Updated by Kill Bill 5 months ago

There's already #6023 for netmap + shaping.

#5 Updated by Kill Bill 3 months ago

In general, I'd say people who wish to use Snort/Suricata as IPS should look into divert sockets instead. The netmap thing is super-broken, hardware limited and in general not getting anywhere AFAICT.

#6 Updated by Jim Thompson 3 months ago

Steven Kreitzer wrote:

Sandeep K V wrote:

Hi Steven Kreitzer and Jim Thompson isn't this the expected way the IPS has to work?

No, and it definitely shouldn't be stripping 802.1q traffic. I know it uses netcap and it may be an error on netcaps side.

My guess is that Suricata is stripping the tags. Likely the queue info is getting lost somewhere in that path as well.

#7 Updated by Jim Thompson 3 months ago

Kill Bill wrote:

There's already #6023 for netmap + shaping.

"Shaping" is a hack that shouldn't have happened.

#8 Updated by Jens Leinenbach 8 days ago

Jim Thompson wrote:

Steven Kreitzer wrote:

Sandeep K V wrote:

Hi Steven Kreitzer and Jim Thompson isn't this the expected way the IPS has to work?

No, and it definitely shouldn't be stripping 802.1q traffic. I know it uses netcap and it may be an error on netcaps side.

My guess is that Suricata is stripping the tags. Likely the queue info is getting lost somewhere in that path as well.

A VLAN tag bug was fixed with Suricata version 3.2.1 that is available for pfSense. Can somebody please verify if this bug still exists as I think I had this issue with version 3.2.1.
https://redmine.openinfosecfoundation.org/issues/1780

Also available in: Atom PDF