Optimization #5453
Updated by Jason Ish over 1 year ago
For testing I configured an IPS test box with 2 interfaces where the external interface had an IP address and the internal address did not. I then used af-packet in ips mode to create the bridge.
Packets seen on the external interface for the hosts on IP address are copied through to the internal interface, this was somewhat expected given what I new by Suricata, but is not what is expected by someone more familiar with the Linux (or BSDs) ethernet bridging support.
Typically an ethernet bridge will have arp tables and learn which mac addresses are on each side of the interface, only "flooding" when it doesn't know what to do with a packet. This would prevent packets destined for the IPS host itself from being "flooded" out the other interface. This would be done by basically mark an arp table within Suricata that knows on which side of the bridge MAC addresses live.
Of course this is not an issue when the 2 interfaces being bridged do not have IP addresses, as in that case you want it to behave more like a coupler.
I also wonder if STP (spanning tree protocol) should be investigated as well, as its also supported and enabled by default in the built-in ethernet bridge modes in Linux and the BSDs.