Suricata

You should try

 /usr/bin/suricata -c /etc/suricata/suricata.yaml --af-packet=em1

instead of

 /usr/bin/suricata -c /etc/suricata/suricata.yaml --af-packet em1

Notice "=" missing.

root@suricata:/home/suricata# /usr/bin/suricata c /etc/suricata/suricata.yaml --af-packet=eno1
26/5/2015 - 19:34:25 - <Notice> - This is Suricata version 2.0.8 RELEASE
26/5/2015 -- 19:34:30 - <Error> - [ERRCODE: SC_ERR_INVALID_ARGUMENT(13)] - Could not get cluster-id from config
26/5/2015 -- 19:34:30 - <Error> - [ERRCODE: SC_ERR_GET_CLUSTER_TYPE_FAILED(35)] - Could not get cluster-type from config
26/5/2015 -- 19:34:30 - <Notice> - all 13 packet processing threads, 3 management threads initialized, engine started.

Peter Manev wrote:

You should try
[...]
pending you have configured the suricata.yaml correctly in the af-packet section for interface em1

instead of
[...]

Notice "=" missing.

Can you please share the the af-packet section in your config?

In the last update you are using "en01" as an interface, in the first report you have provided an extract if the interfaces available on your system, - "em1" ...which one is it? "em1" or "en01" ?

Hi Peter,

Thank you for looking into this. The interface name was em1 earlier while troubleshooting I changed the em1 to eno1. Currently I am using eno1 interface to run suricata through af-packate capture. Not sure how to deal with above errors (error code 13 and 35). Also how to get af-packet section in your config?

Peter Manev wrote:

Can you please share the the af-packet section in your config?

In the last update you are using "en01" as an interface, in the first report you have provided an extract if the interfaces available on your system, - "em1" ...which one is it? "em1" or "en01" ?

Can you please copy/paste the section in your suricata.yaml regarding af-packet here. (you can use pastebin or similar if you would like )

Peter Manev wrote:

Can you please copy/paste the section in your suricata.yaml regarding af-packet here. (you can use pastebin or similar if you would like )

1. Default clusterid. AF_PACKET will load balance packets based on flow. # All threads/processes that will participate need to have the same # clusterid.
   cluster-id: 99 # Default AF_PACKET cluster type. AF_PACKET can load balance per flow or per hash. # This is only supported for Linux kernel > 3.1 # possible value are: # * cluster_round_robin: round robin load balancing # * cluster_flow: all packets of a given flow are send to the same socket # * cluster_cpu: all packets treated in kernel by a CPU are send to the same socket
   cluster-type: cluster_flow # In some fragmentation case, the hash can not be computed. If "defrag" is set # to yes, the kernel will do the needed defragmentation before sending the packets.
   defrag: yes # To use the ring feature of AF_PACKET, set 'use-mmap' to yes
   use-mmap: yes # Ring size will be computed with respect to max_pending_packets and number # of threads. You can set manually the ring size in number of packets by setting # the following value. If you are using flow cluster-type and have really network # intensive single-flow you could want to set the ring-size independantly of the number # of threads:
   #ring-size: 2048 # On busy system, this could help to set it to yes to recover from a packet drop # phase. This will result in some packets (at max a ring flush) being non treated.
   #use-emergency-flush: yes # recv buffer size, increase value could improve performance # buffer-size: 32768 # Set to yes to disable promiscuous mode # disable-promisc: no # Choose checksum verification mode for the interface. At the moment # of the capture, some packets may be with an invalid checksum due to # offloading to the network card of the checksum computation. # Possible values are: # - kernel: use indication sent by kernel for each packet (default) # - yes: checksum validation is forced # - no: checksum validation is disabled # - auto: suricata uses a statistical approach to detect when # checksum off-loading is used. # Warning: 'checksum-validation' must be set to yes to have any validation
   #checksum-checks: kernel # BPF filter to apply to this interface. The pcap filter syntax apply here.
   #bpf-filter: port 80 or udp # You can use the following variables to activate AF_PACKET tap od IPS mode. # If copy-mode is set to ips or tap, the traffic coming to the current # interface will be copied to the copy-iface interface. If 'tap' is set, the # copy is complete. If 'ips' is set, the packet matching a 'drop' action # will not be copied.
   #copy-mode: ips
   #copy-iface: eth1
   - interface: eth1
   threads: 1
   cluster-id: 98
   cluster-type: cluster_flow
   defrag: yes # buffer-size: 32768 # disable-promisc: no # Put default values here
   - interface: default
   #threads: 2
   #use-mmap: yes

Mustaque Ahmad wrote: Hi Peter the issue is fixed. Its just I have to change the interface name in suricata.yaml (config) file. I tested with testmyids.com and able to see the alert. Moreover, I will be configuring port mirroring on switch and connect that to interface 2 of the suricata server. Is there any setting needs to be done so that Suricata will see all the traffic on the network. Please suggest. Thanks for the help..

Peter Manev wrote:

Can you please copy/paste the section in your suricata.yaml regarding af-packet here. (you can use pastebin or similar if you would like )

1. Default clusterid. AF_PACKET will load balance packets based on flow.
2. All threads/processes that will participate need to have the same
3. clusterid.
   cluster-id: 99
4. Default AF_PACKET cluster type. AF_PACKET can load balance per flow or per hash.
5. This is only supported for Linux kernel > 3.1
6. possible value are:
7. * cluster_round_robin: round robin load balancing
8. * cluster_flow: all packets of a given flow are send to the same socket
9. * cluster_cpu: all packets treated in kernel by a CPU are send to the same socket
   cluster-type: cluster_flow
10. In some fragmentation case, the hash can not be computed. If "defrag" is set
11. to yes, the kernel will do the needed defragmentation before sending the packets.
    defrag: yes
12. To use the ring feature of AF_PACKET, set 'use-mmap' to yes
    use-mmap: yes
13. Ring size will be computed with respect to max_pending_packets and number
14. of threads. You can set manually the ring size in number of packets by setting
15. the following value. If you are using flow cluster-type and have really network
16. intensive single-flow you could want to set the ring-size independantly of the number
17. of threads:
    #ring-size: 2048
18. On busy system, this could help to set it to yes to recover from a packet drop
19. phase. This will result in some packets (at max a ring flush) being non treated.
    #use-emergency-flush: yes
20. recv buffer size, increase value could improve performance
21. buffer-size: 32768
22. Set to yes to disable promiscuous mode
23. disable-promisc: no
24. Choose checksum verification mode for the interface. At the moment
25. of the capture, some packets may be with an invalid checksum due to
26. offloading to the network card of the checksum computation.
27. Possible values are:
28. - kernel: use indication sent by kernel for each packet (default)
29. - yes: checksum validation is forced
30. - no: checksum validation is disabled
31. - auto: suricata uses a statistical approach to detect when
32. checksum off-loading is used.
33. Warning: 'checksum-validation' must be set to yes to have any validation
    #checksum-checks: kernel
34. BPF filter to apply to this interface. The pcap filter syntax apply here.
    #bpf-filter: port 80 or udp
35. You can use the following variables to activate AF_PACKET tap od IPS mode.
36. If copy-mode is set to ips or tap, the traffic coming to the current
37. interface will be copied to the copy-iface interface. If 'tap' is set, the
38. copy is complete. If 'ips' is set, the packet matching a 'drop' action
39. will not be copied.
    #copy-mode: ips
    #copy-iface: eth1
    - interface: eth1
    threads: 1
    cluster-id: 98
    cluster-type: cluster_flow
    defrag: yes
40. buffer-size: 32768
41. disable-promisc: no
42. Put default values here
    - interface: default
    #threads: 2
    #use-mmap: yes