Re: Running Zeek & Suricata on Same Network Interface

Not much to add to the conversation except to say that where I work we have
a large Docker-based deployment and have observed no issues compared to our
previous bare metal install (in some locations performance increased).

On Fri, Apr 19, 2019 at 4:25 PM Patrick Kelley <
[email protected]> wrote:

> You are most welcome.
>
> As always, reach out if you have any questions.
>
> On Fri, Apr 19, 2019 at 7:20 PM TQ <[email protected]> wrote:
>
>> Thank you Michal and Patrick!  I learned something new today and will
>> take a look at your git repo. to learn more.  I currently have them both on
>> docker for easy maintenance (reload if something goes wrong).  Have a great
>> weekend!
>>
>> On Fri, Apr 19, 2019 at 4:15 PM Patrick Kelley <
>> [email protected]> wrote:
>>
>>> Works fine.
>>>
>>> I've used a docker container once, for this purpose.  It did fine, but
>>> like Michal, I don't recommend it.
>>>
>>> On Fri, Apr 19, 2019 at 7:10 PM Michał Purzyński <
>>> [email protected]> wrote:
>>>
>>>> There is no need to use SR-IOV and other fancy features, everything
>>>> just works. Not sure about docker, I don't use that for any
>>>> production-worthy workload (for performance reasons, it corrupts data
>>>> randomly, etc).
>>>>
>>>> Just use AF_Packet and use a different cluster_id for each and you will
>>>> be fine. You can even use different number of threads (for Suri) and
>>>> processes (for Zeek).
>>>>
>>>> The first part of SEPTun I wrote with Suricata devs might be useful for
>>>> Zeek as well. And keep asking questions.
>>>>
>>>> https://github.com/pevma/SEPTun
>>>> https://github.com/pevma/SEPTun-Mark-II/blob/master/README.md
>>>>
>>>> Sharing host between Suricata and Zeek is how we run our office sensors.
>>>>
>>>>
>>>>
>>>> On Sat, Apr 20, 2019 at 12:52 AM TQ <[email protected]> wrote:
>>>>
>>>>> Hello All,
>>>>>
>>>>> Has anyone ran Zeek and Suricata (or something similar) off from the
>>>>> same network interface; especially via docker?  If yes, did you see any
>>>>> issues at all?  I shortly ran both off from the same interface, but wasn't
>>>>> very sure due to minimum traffic.  Is it better to get a fancy Intel NIC
>>>>> with SR-IOV feature and spawn off virtual interfaces?  Have a great weekend
>>>>> all.
>>>>>
>>>>> Thanks,
>>>>> _______________________________________________
>>>>> Zeek mailing list
>>>>> [email protected]
>>>>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
>>>>
>>>> _______________________________________________
>>>> Zeek mailing list
>>>> [email protected]
>>>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
>>>
>>>
>>>
>>> --
>>>
>>> *Patrick Kelley, CISSP, C|EH, ITIL*
>>> *CTO*
>>> [email protected]
>>> (o) 770-224-6482
>>>
>>> *The limit to which you have accepted being comfortable is the limit to
>>> which you have grown. Accept new challenges as an opportunity to enrich
>>> yourself and not as a point of potential failure.*
>>>
>>>
>>>
>
> --
>
> *Patrick Kelley, CISSP, C|EH, ITIL*
> *CTO*
> [email protected]
> (o) 770-224-6482
>
> *The limit to which you have accepted being comfortable is the limit to
> which you have grown. Accept new challenges as an opportunity to enrich
> yourself and not as a point of potential failure.*
>
>
> _______________________________________________
> Zeek mailing list
> [email protected]
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek