Re: Running Zeek & Suricata on Same Network Interface

There is no need to use SR-IOV and other fancy features, everything just
works. Not sure about docker, I don't use that for any production-worthy
workload (for performance reasons, it corrupts data randomly, etc).

Just use AF_Packet and use a different cluster_id for each and you will be
fine. You can even use different number of threads (for Suri) and processes
(for Zeek).

The first part of SEPTun I wrote with Suricata devs might be useful for
Zeek as well. And keep asking questions.

https://github.com/pevma/SEPTun
https://github.com/pevma/SEPTun-Mark-II/blob/master/README.md

Sharing host between Suricata and Zeek is how we run our office sensors.



On Sat, Apr 20, 2019 at 12:52 AM TQ <[email protected]> wrote:

> Hello All,
>
> Has anyone ran Zeek and Suricata (or something similar) off from the same
> network interface; especially via docker?  If yes, did you see any issues
> at all?  I shortly ran both off from the same interface, but wasn't very
> sure due to minimum traffic.  Is it better to get a fancy Intel NIC with
> SR-IOV feature and spawn off virtual interfaces?  Have a great weekend all.
>
> Thanks,
> _______________________________________________
> Zeek mailing list
> [email protected]
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek