Suricata

IPS did not pass traffic with or without pass rules:

pass ip any any <> any any (msg:"IP pass"; sid:3031; rev:1;)

pass tcp any any <> any any (msg:"TCP pass"; sid:3032; rev:1;)

related: https://redmine.openinfosecfoundation.org/issues/6587

As mentioned in the other bug, I am finding the same behavior using af-packet in tap and IPS mode.

Hi @ftrudeau,

have you tested the functionality with other capture modes as well?
Can't it be possible there is a configuration issue?

Sorry, ok, I followed your comments in other tickets and I see there is some underlying issue with the setup/Suricata. Considering it works neither with AFP or with DPDK it seems like the capture modules is not the one to blame.

Lukas Sismis wrote in #note-3:

Hi @ftrudeau,

have you tested the functionality with other capture modes as well?
Can't it be possible there is a configuration issue?

See this related bug:

https://redmine.openinfosecfoundation.org/issues/6587

If I create a bridge and use the same config file, except with '-i br0' instead of '--dpdk', I see detections.

This is also happening with '--af-packet'

I have not had issues using the e1000 virtual interfaces, and it's generally the solution others run into as well.

virtio is a known issue, ticket #5871.

An issue, even with e1000, is that offloads need to be disabled on the host as well as the virtual NIC, or at least in my experience, things begin to break.

I wonder if we can close this in favor of #5871?