Re: Issues running snort 3 in multi threaded mode.

If you need IPS and high performance you can use AF_PACKET. (For input 
and output interface. This feature works like a bridge.) AF_PACKET works 
with multi-threaded.

If you are going to analyze passively (pcap) for more than one network, 
you should run separate snort for each interface. (If you want to block, 
snortsum can be used)

In addition, if you want to use the networks by separating them from 
each other with rules;
Create dummy interface for each snort.(ip link add name snort1 type dummy)
Then create qdisc with the TC command and mirror the traffic to this 
dummy interface. You can match networks by using TC command and ipset at 
the same time.
Run snort for the dummy interface (snort1, snort2)

https://man7.org/linux/man-pages/man8/tc-mirred.8.html
https://man7.org/linux/man-pages/man8/tc-ematch.8.html

Fatih USTA

On 30.03.2022 12:40, Andrew Welham wrote:
>
> Hi,
>
> Shame i'm trying to route on a new 1GB internet connection with major 
> performance issues in snort
> I did have a thought though,
> If i have multiple networks, some with internet facing servers. These 
> obviously need IPS in both directions.
>
> For clients (pcs) as there are no inbound connections connection, is 
> it a reasonable options to only test outbound traffic, to catch bad 
> connection etc, but not inbound, as there are no inbound triggered 
> connections allowed.
> This also helps as the performance issues are caused by inbound 
> traffic to the clients?
>
> Thanks
>
>
>
> On 30/03/2022 08:01, Fatih USTA wrote:
>> Hi
>>
>> Snort3 doesn't support multi thread with nfq mod.
>>
>> I asked same question before.
>>
>> https://github.com/snort3/snort3/issues/164#issuecomment-804597085
>>
>>
>> Fatih USTA
>>
>> On 30.03.2022 09:03, Andrew Welham wrote:
>>> Dear All,
>>>
>>> I'm trying to run snort 3 in multi threaded mode. As i only appear 
>>> to have a single thread with maxes out at 100% cpu utilisation, when 
>>> other cores in the servers are not utilised.
>>> I am running using NFQUEUE as i also have a firewall on the same 
>>> router.
>>>
>>> I added -z 4 to the command i use.
>>>
>>> /usr/local/bin/snort -c /usr/local/etc/snort/snort.lua -s 65535 -k 
>>> none -l /var/log/snort -D -m 0x1b -Q -z 4
>>>
>>>
>>> Although snort launches i get the following errors, and snort while 
>>> working does not run in multithreaded mode.
>>>
>>> nfq DAQ configured to inline.
>>> initializing daemon mode
>>> child process is 39280
>>> Commencing packet processing
>>> # ++ [0] 0
>>> ++ [1] 0
>>> ++ [2] 0
>>> ++ [3] 0
>>> Error receiving message from the DAQ instance: nfq_daq_msg_receive: 
>>> Netlink message processing failed: -1 - Operation not permitted (1)
>>> -- [1] 0
>>> Error receiving message from the DAQ instance: nfq_daq_msg_receive: 
>>> Netlink message processing failed: -1 - Operation not permitted (1)
>>> Error receiving message from the DAQ instance: nfq_daq_msg_receive: 
>>> Netlink message processing failed: -1 - Operation not permitted (1)
>>> -- [3] 0
>>> -- [2] 0
>>>
>>>
>>> Is it possible to run snort 3 in multi threaded mode with NFQUEUE.
>>> Have i made some type of config error
>>>
>>>
>>> Many Thanks
>>> _______________________________________________
>>> Snort-users mailing list
>>> [email protected]
>>> Go to this URL to change user options or unsubscribe:
>>> https://lists.snort.org/mailman/listinfo/snort-users
>>>
>>>     To unsubscribe, send an email to:
>>>     [email protected]
>>>
>>> Please visit http://blog.snort.org to stay current on all the latest 
>>> Snort news!
>>>
>>> Please follow these rules: 
>>> https://snort.org/faq/what-is-the-mailing-list-etiquette
>
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette