Re: Running Zeek & Suricata on Same Network Interface
Patrick Kelley <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CA+WAcdQacRy8U5wSwE2yB5ZjAnswq2dQ_L9tNJtN0ceMHA6d0w@mail.gmail.com> |
You are most welcome. As always, reach out if you have any questions. On Fri, Apr 19, 2019 at 7:20 PM TQ <[email protected]> wrote: > Thank you Michal and Patrick! I learned something new today and will take > a look at your git repo. to learn more. I currently have them both on > docker for easy maintenance (reload if something goes wrong). Have a great > weekend! > > On Fri, Apr 19, 2019 at 4:15 PM Patrick Kelley < > [email protected]> wrote: > >> Works fine. >> >> I've used a docker container once, for this purpose. It did fine, but >> like Michal, I don't recommend it. >> >> On Fri, Apr 19, 2019 at 7:10 PM Michał Purzyński < >> [email protected]> wrote: >> >>> There is no need to use SR-IOV and other fancy features, everything just >>> works. Not sure about docker, I don't use that for any production-worthy >>> workload (for performance reasons, it corrupts data randomly, etc). >>> >>> Just use AF_Packet and use a different cluster_id for each and you will >>> be fine. You can even use different number of threads (for Suri) and >>> processes (for Zeek). >>> >>> The first part of SEPTun I wrote with Suricata devs might be useful for >>> Zeek as well. And keep asking questions. >>> >>> https://github.com/pevma/SEPTun >>> https://github.com/pevma/SEPTun-Mark-II/blob/master/README.md >>> >>> Sharing host between Suricata and Zeek is how we run our office sensors. >>> >>> >>> >>> On Sat, Apr 20, 2019 at 12:52 AM TQ <[email protected]> wrote: >>> >>>> Hello All, >>>> >>>> Has anyone ran Zeek and Suricata (or something similar) off from the >>>> same network interface; especially via docker? If yes, did you see any >>>> issues at all? I shortly ran both off from the same interface, but wasn't >>>> very sure due to minimum traffic. Is it better to get a fancy Intel NIC >>>> with SR-IOV feature and spawn off virtual interfaces? Have a great weekend >>>> all. >>>> >>>> Thanks, >>>> _______________________________________________ >>>> Zeek mailing list >>>> [email protected] >>>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek >>> >>> _______________________________________________ >>> Zeek mailing list >>> [email protected] >>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek >> >> >> >> -- >> >> *Patrick Kelley, CISSP, C|EH, ITIL* >> *CTO* >> [email protected] >> (o) 770-224-6482 >> >> *The limit to which you have accepted being comfortable is the limit to >> which you have grown. Accept new challenges as an opportunity to enrich >> yourself and not as a point of potential failure.* >> >> >> -- *Patrick Kelley, CISSP, C|EH, ITIL* *CTO* [email protected] (o) 770-224-6482 *The limit to which you have accepted being comfortable is the limit to which you have grown. Accept new challenges as an opportunity to enrich yourself and not as a point of potential failure.* _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek