Suricata

Current work-around with code changes for IDS mode only:

# 65535 + 14
default-packet-size: 65549

af-packet
  - interface: enp10s0
    defrag: true
    # Required for custom block-size, but not recommended for IPS.
    tpacket-v3: true
    # Large enough 32 packets of default-packet-size.
    block-size: 2097152

For t-packet v2, as well as IPS mode I guess the best thing is to disable defrag. However, turning off defrag is necessary for IPS setups.

Questions:
- What is the impact of increasing this block size?
- What is the impact of increasing the default packet size?
- Can we/should we modify the code to fix this for tpacket-v2 (which is the default)?

Should we look at better defaults? If IDS, default to tpacket-v3 with large packet size? If IPS, force off defrag?

I think it would be rather trivial to stuff something like DNS requests with extra data such that Suricata IDS defaults would always see the packets as truncated. Or perform some UDP tunneling in large packets that are always fragmented and seen as truncated by Suricata, using the defaults.

To keep with tpacket v2, I had to make this adjustment:

#define AFP_BLOCK_SIZE_DEFAULT_ORDER 5

Where the value is currently 3.