Bug #1284


AF_PACKET IPS mode not logging drop and stream inline issue

Added by Eric Leblond over 9 years ago. Updated over 9 years ago.

Target version:
Affected Versions:


The problem

As reported on mailing list:

When I set suricata run with af-packet ips mode, I found it can’t record “drop.log” or drop log within eve.log. I found the source code don’t support this. When it record drop log, the engine must run ENGINE_MODE_IPS, but this only when NFQ and IPFW mode set this value.

static int JsonDropLogCondition(ThreadVars *tv, const Packet *p) {
    if (!EngineModeIsIPS()) {
        SCLogDebug("engine is not running in inline mode, so returning");
        return FALSE;

Analysis and cause:

AF_PACKET is not setting the engine mode to IPS when some interfaces are peered. This is due to the fact, it is possible to peer 2 interfaces and run an IPS on them and have a third one that is running in normal IDS mode.

Unwanted side effect is that there is no drop log. An other side effect is that stream-inline is not activated automatically when AF_PACKET is used in IPS mode.


For backward compatibility we can not assume that a configuration with mixed IPS and IDS interfaces is wrong. So a solution is to do the following:
  1. If af-packet is full IPS, we set IPS mode and this will activate stream inline.
  2. If af-packet is in mixed mode, we add a warning message stating that this is not a good idea.
Actions #1

Updated by Eric Leblond over 9 years ago

Following discussion on IRC, we agree to the following solution. If suricata run with mixed mode interface:
  • listen to all ifaces
  • warn on IDS one (error message)
  • set IPS mode
Actions #2

Updated by Victor Julien over 9 years ago

  • Assignee set to Eric Leblond
  • Target version set to 2.0.4

Would like to get this fixed in the 2.0.4 release next week.

Actions #3

Updated by Victor Julien over 9 years ago

  • Status changed from New to Closed
  • % Done changed from 0 to 100

Also available in: Atom PDF