Project

General

Profile

Actions
Copy link

Bug #8242

open
JG SS

eBPF maps created by Suricata don't take vlan.use-for-tracking into account

Bug #8242: eBPF maps created by Suricata don't take vlan.use-for-tracking into account

Added by John Graat 10 months ago. Updated 4 months ago.

Status:
In Review
Priority:
Normal
Assignee:
Samaresh Kumar singh
Target version:
TBD
Affected Versions:
8.0.2
Effort:
Difficulty:
Label:

Description

Hi,

I was testing with eBPF/XDP on one of my servers (Intel X710). I have VLAN tracking disabled so vlan.use-for-tracking=0 in my suricata.yaml.
In the supplied eBPF code xdp_filter.c, VLAN_TRACKING was set to 0 before compilation into .bpf.

No matter what I tried, all hardware bypass counters remained 0. Then I started dumping the underlying BPF map (bpftool map dump name flow_table_v4) to see what was in there and saw that vlan0 was filled with the VLAN on which the data was captured. This should have been 0 in my opinion as I don't want to track the VLAN id. The loaded BPF code always fills vlan0 and vlan1 with 0 and so there would never be a match in the map filled by Suricata.

I fixed it in source-af-packet.c and now bypass does work for both IPv4 and IPv6. See attachment for a patch.

Could someone please review and apply the patch if agreed upon?

Thanks, John

Files

source-af-packet.c.patch (4.33 KB) source-af-packet.c.patch Patch that takes vlan.use-for-tracking into account John Graat, 01/21/2026 01:05 PM

Related issues 1 (0 open — 1 closed)

Has duplicate Suricata - Bug #4214: Honor vlan: use-for-tracking in ebpf mapsRejectedCommunity TicketActions

VJ Updated by Victor Julien 10 months ago Actions
Copy link
 #1

Hi John, any chance you'll be able to contribute this through our regular process?

Please see: https://docs.suricata.io/en/latest/devguide/contributing/index.html

JG Updated by John Graat 10 months ago Actions
Copy link
 #2

  • Label Needs backport added

Victor Julien wrote in #note-1:

Hi John, any chance you'll be able to contribute this through our regular process?

Please see: https://docs.suricata.io/en/latest/devguide/contributing/index.html

Yes, I will do that somewhere next week.

John

SS Updated by Samaresh Kumar singh 6 months ago Actions
Copy link
 #3

  • Assignee set to Samaresh Kumar singh

JF Updated by Juliana Fajardini Reichow 6 months ago Actions
Copy link
 #4

  • Status changed from New to Assigned

LS Updated by Lukas Sismis 4 months ago Actions
Copy link
 #5

  • Status changed from Assigned to In Review

PA Updated by Philippe Antoine 4 months ago Actions
Copy link
 #6

  • Has duplicate Bug #4214: Honor vlan: use-for-tracking in ebpf maps added

PA Updated by Philippe Antoine 4 months ago Actions
Copy link
 #7

  • Label deleted (Needs backport)
Actions
Copy link

Also available in: PDF Atom