Bug #6690
closedSURICATA IPS Issue - Kills VLANS & Traffic Shaper
Added by Steven Kreitzer about 10 years ago. Updated over 6 years ago.
0%
Description
Strips 802.1q tagged traffic from an interface when running inline IPS mode.
Traffic shapper no longer works as one single interface can use up the whole upstream bandwidth.
JT Updated by Jim Thompson about 10 years ago Actions #1
- Category set to Suricata
- Assignee set to Luiz Souza
- Target version set to 2.4.0
- Affected Version set to 2.3.x
- Affected Architecture All added
- Affected Architecture deleted (
)
SK Updated by Sandeep K V about 10 years ago Actions #2
Hi Steven Kreitzer and Jim Thompson isn't this the expected way the IPS has to work?
SK Updated by Steven Kreitzer about 10 years ago Actions #3
Sandeep K V wrote:
Hi Steven Kreitzer and Jim Thompson isn't this the expected way the IPS has to work?
No, and it definitely shouldn't be stripping 802.1q traffic. I know it uses netcap and it may be an error on netcaps side.
KB Updated by Kill Bill almost 10 years ago Actions #4
There's already #6023 for netmap + shaping.
KB Updated by Kill Bill over 9 years ago Actions #5
In general, I'd say people who wish to use Snort/Suricata as IPS should look into divert sockets instead. The netmap thing is super-broken, hardware limited and in general not getting anywhere AFAICT.
JT Updated by Jim Thompson over 9 years ago Actions #6
Steven Kreitzer wrote:
Sandeep K V wrote:
Hi Steven Kreitzer and Jim Thompson isn't this the expected way the IPS has to work?
No, and it definitely shouldn't be stripping 802.1q traffic. I know it uses netcap and it may be an error on netcaps side.
My guess is that Suricata is stripping the tags. Likely the queue info is getting lost somewhere in that path as well.
JT Updated by Jim Thompson over 9 years ago Actions #7
Kill Bill wrote:
There's already #6023 for netmap + shaping.
"Shaping" is a hack that shouldn't have happened.
JL Updated by Jens Leinenbach over 9 years ago Actions #8
Jim Thompson wrote:
Steven Kreitzer wrote:
Sandeep K V wrote:
Hi Steven Kreitzer and Jim Thompson isn't this the expected way the IPS has to work?
No, and it definitely shouldn't be stripping 802.1q traffic. I know it uses netcap and it may be an error on netcaps side.
My guess is that Suricata is stripping the tags. Likely the queue info is getting lost somewhere in that path as well.
A VLAN tag bug was fixed with Suricata version 3.2.1 that is available for pfSense. Can somebody please verify if this bug still exists as I think I had this issue with version 3.2.1.
https://redmine.openinfosecfoundation.org/issues/1780
LS Updated by Luiz Souza about 9 years ago Actions #9
- Target version changed from 2.4.0 to 2.4.1
JP Updated by Jim Pingle almost 9 years ago Actions #10
- Target version changed from 2.4.1 to 2.4.2
JP Updated by Jim Pingle almost 9 years ago Actions #11
- Target version changed from 2.4.2 to 2.4.3
JP Updated by Jim Pingle over 8 years ago Actions #12
- Status changed from New to Feedback
- Target version changed from 2.4.3 to 2.4.4
Still waiting on feedback/new testing on current versions of pfSense and suricata
Updated by Anonymous over 8 years ago
Actions
#13
- Status changed from Feedback to Closed
- Target version deleted (
2.4.4)
Marking this closed due to lack of feedback. If you believe this should be reopened, please let us know.
TT Updated by Tenzen Tunkman over 6 years ago Actions #14
This issue is still not solved - Inline filtering will break traffic shaping as well as for example traffic graph functionality
BM Updated by Bill Meeks over 6 years ago Actions #15
Tenzen Tunkman wrote:
This issue is still not solved - Inline filtering will break traffic shaping as well as for example traffic graph functionality
This may actually be a limitation inherent in the way netmap works and not really a bug that is easily fixable. Netmap is a somewhat radically different "plumbing method" for routing network traffic, and as such is likely to break other ancilary features like limiters that rely on the more conventional kernel-based network plumbing.
If a user has a strong need for limiters, it may be better to put Suricata on a different hardware platform either upstream of downstream of the firewall such that the limiter can run on the firewall with conventional networking while the inline IPS executes on a different box where the unconventional netmap re-mapping of the network plumbing won't impact limiters or traffic graphing. I get this is not as attractive as a one-box solution, but with some technologies there are tradeoffs.
Also available in: Atom