Re: Running Zeek & Suricata on Same Network Interface
Joe Blow <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <[email protected]> |
Have you done any config magic? Docker compose? What circumstances surrounded the performance increase? I know a bunch of folks swear by pcap in containers, but I've never done 10gb+ in docker. Cheers, JB Sent via the BlackBerry Hub for Android From: [email protected] Sent: April 19, 2019 7:35 PM To: [email protected] Cc: [email protected]; [email protected] Subject: Re: [Zeek] Running Zeek & Suricata on Same Network Interface Not much to add to the conversation except to say that where I work we have a large Docker-based deployment and have observed no issues compared to our previous bare metal install (in some locations performance increased). On Fri, Apr 19, 2019 at 4:25 PM Patrick Kelley <[email protected] > wrote: You are most welcome. As always, reach out if you have any questions. On Fri, Apr 19, 2019 at 7:20 PM TQ <[email protected] > wrote: Thank you Michal and Patrick! I learned something new today and will take a look at your git repo. to learn more. I currently have them both on docker for easy maintenance (reload if something goes wrong). Have a great weekend! On Fri, Apr 19, 2019 at 4:15 PM Patrick Kelley <[email protected] > wrote: Works fine. I've used a docker container once, for this purpose. It did fine, but like Michal, I don't recommend it. On Fri, Apr 19, 2019 at 7:10 PM Michał Purzyński <[email protected] > wrote: There is no need to use SR-IOV and other fancy features, everything just works. Not sure about docker, I don't use that for any production-worthy workload (for performance reasons, it corrupts data randomly, etc). Just use AF_Packet and use a different cluster_id for each and you will be fine. You can even use different number of threads (for Suri) and processes (for Zeek). The first part of SEPTun I wrote with Suricata devs might be useful for Zeek as well. And keep asking questions. https://github.com/pevma/SEPTun https://github.com/pevma/SEPTun-Mark-II/blob/master/README.md Sharing host between Suricata and Zeek is how we run our office sensors. On Sat, Apr 20, 2019 at 12:52 AM TQ <[email protected] > wrote: Hello All, Has anyone ran Zeek and Suricata (or something similar) off from the same network interface; especially via docker? If yes, did you see any issues at all? I shortly ran both off from the same interface, but wasn't very sure due to minimum traffic. Is it better to get a fancy Intel NIC with SR-IOV feature and spawn off virtual interfaces? Have a great weekend all. Thanks, _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek -- Patrick Kelley, CISSP, C|EH, ITIL CTO [email protected] (o) 770-224-6482 The limit to which you have accepted being comfortable is the limit to which you have grown. Accept new challenges as an opportunity to enrich yourself and not as a point of potential failure. -- Patrick Kelley, CISSP, C|EH, ITIL CTO [email protected] (o) 770-224-6482 The limit to which you have accepted being comfortable is the limit to which you have grown. Accept new challenges as an opportunity to enrich yourself and not as a point of potential failure. _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek