1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
|
Netmap
======
Netmap is a high speed capture framework for Linux and FreeBSD. In Linux it
is available as an external module, while in FreeBSD 11+ it is available by
default.
Compiling Suricata
------------------
FreeBSD
~~~~~~~
On FreeBSD 11 and up, NETMAP is included and enabled by default in the kernel.
To build Suricata with NETMAP, add ``--enable-netmap`` to the configure line.
The location of the NETMAP includes (/usr/src/sys/net/) does not have to be
specified.
Linux
~~~~~
On Linux, NETMAP is not included by default. It can be pulled from github.
Follow the instructions on installation included in the NETMAP repository.
When NETMAP is installed, add ``--enable-netmap`` to the configure line.
If the includes are not added to a standard location, the location can
be specified when configuring Suricata.
Example::
./configure --enable-netmap --with-netmap-includes=/usr/local/include/netmap/
Starting Suricata
-----------------
When opening an interface, netmap can take various special characters as
options in the interface string.
.. warning:: the interface that netmap reads from will become unavailable
for normal network operations. You can lock yourself out of
your system.
IDS
~~~
Suricata can be started in 2 ways to use netmap:
::
suricata --netmap=<interface>
suricata --netmap=igb0
In the above example Suricata will start reading from the `igb0` network interface.
The number of threads created depends on the number of RSS queues available on the NIC.
::
suricata --netmap
In the above example Suricata will take the ``netmap`` block from the Suricata
configuration and open each of the interfaces listed.
::
netmap:
- interface: igb0
threads: 2
- interface: igb1
threads: 4
For the above configuration, both ``igb0`` and ``igb1`` would be opened. With 2
threads for ``igb0`` and 4 capture threads for ``igb1``.
.. warning:: This multi threaded setup only works correctly if the NIC
has symmetric RSS hashing. If this is not the case, consider
using the 'lb' method below.
IPS
~~~
Suricata's Netmap based IPS mode is based on the concept of creating
a layer 2 software bridge between 2 interfaces. Suricata reads packets on
one interface and transmits them on another.
Packets that are blocked by the IPS policy, are simply not transmitted.
::
netmap:
- interface: igb0
copy-mode: ips
copy-iface: igb1
- interface: igb1
copy-mode: ips
copy-iface: igb0
Advanced setups
---------------
lb (load balance)
-----------------
"lb" is a tool written by Seth Hall to allow for load balancing for single
or multiple tools. One common use case is being able to run Suricata and
Zeek together on the same traffic.
starting lb::
lb -i eth0 -p suricata:6 -p zeek:6
.. note:: On FreeBSD 11, the named prefix doesn't work.
yaml::
netmap:
- interface: netmap:suricata
threads: 6
startup::
suricata --netmap=netmap:suricata
The interface name as passed to Suricata includes a 'netmap:' prefix. This
tells Suricata that it's going to read from netmap pipes instead of a real
interface.
Then Zeek (formerly Bro) can be configured to load 6 instances. Both will
get a copy of the same traffic. The number of netmap pipes does not have
to be equal for both tools.
FreeBSD 11
~~~~~~~~~~
On FreeBSD 11 the named pipe is not available.
starting lb::
lb -i eth0 -p 6
yaml::
netmap:
- interface: netmap:eth0
threads: 6
startup::
suricata --netmap
.. note:: "lb" is bundled with netmap.
Single NIC
~~~~~~~~~~
When an interface enters NETMAP mode, it is no longer available to
the OS for other operations. This can be undesirable in certain
cases, but there is a workaround.
By running Suricata in a special inline mode, the interface will
show it's traffic to the OS.
::
netmap:
- interface: igb0
copy-mode: tap
copy-iface: igb0^
- interface: igb0^
copy-mode: tap
copy-iface: igb0
The copy-mode can be both 'tap' and 'ips', where the former never
drops packets based on the policies in use, and the latter may drop
packets.
.. warning:: Misconfiguration can lead to connectivity loss. Use
with care.
.. note:: This set up can also be used to mix NETMAP with firewall
setups like pf or ipfw.
VALE switches
~~~~~~~~~~~~~
VALE is a virtual switch that can be used to create an all virtual
network or a mix of virtual and real nics.
A simple all virtual setup::
vale-ctl -n vi0
vale-ctl -a vale0:vi0
vale-ctl -n vi1
vale-ctl -a vale0:vi1
We now have a virtual switch "vale0" with 2 ports "vi0" and "vi1".
We can start Suricata to listen on one of the ports::
suricata --netmap=vale0:vi1
Then we can
Inline IDS
----------
The inline IDS is almost the same as the IPS setup above, but it will not
enforce ``drop`` policies.
::
netmap:
- interface: igb0
copy-mode: tap
copy-iface: igb1
- interface: igb1
copy-mode: tap
copy-iface: igb0
The only difference with the IPS mode is that the ``copy-mode`` setting is
set to ``tap``.
|
