Project

General

Profile

Actions
Copy link

Support #2997

closed
LI CT

IPS AF_Packet mode and decoder invalid

Support #2997: IPS AF_Packet mode and decoder invalid

Added by Leonid Inodin almost 7 years ago. Updated over 6 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Community Ticket
Affected Versions:
Label:

Description

When using Suricata in IPS AF_Packet mode with "threads: 1" in interfaces configs the latency is quite big (+ from 30 to 100+ in ICMP). If I use "threads: >1" (both interfaces), I got "decoder invalid" parameter is growing very fast. Suricata build 2019040702-0stamus0, kernel: Linux SELKS 4.9.0-9-amd64 #1 SMP Debian 4.9.168-1+deb9u2 (2019-05-13) x86_64 GNU/Linux.

Related issues 1 (0 open — 1 closed)

Related to Suricata - Bug #1778: af_packet: IPS and defragClosedEric LeblondActions

LI Updated by Leonid Inodin almost 7 years ago Actions
Copy link
 #1

Seems that using "defrag:no" parameter in config file solves thuis problem.

VJ Updated by Victor Julien almost 7 years ago Actions
Copy link
 #2

  • Affected Versions deleted (5.0.0)

VJ Updated by Victor Julien almost 7 years ago Actions
Copy link
 #3

  • Related to Bug #1778: af_packet: IPS and defrag added

AH Updated by Andreas Herz almost 7 years ago Actions
Copy link
 #4

  • Assignee set to Community Ticket
  • Target version set to TBD

Can you tell us a bit more about your setup, especially the hardware (NIC)?
What type of traffic it is as well?

VJ Updated by Victor Julien over 6 years ago Actions
Copy link
 #5

  • Status changed from New to Closed
  • Target version deleted (TBD)

VJ Updated by Victor Julien over 6 years ago Actions
Copy link
 #6

  • Tracker changed from Bug to Support
Actions
Copy link

Also available in: PDF Atom