Re: Issues running snort 3 in multi threaded mode.

I did  try AF_PACKET mode (earlier) , but i have 10 interfaces (2 of 
which are internet connections, the other 8 need to access the 
internet)  and as far as i can remember AFPacket modes only allows you 
to bridge between  2 interfaces at a time , plus i had  iirc issues with 
the f/w rules not working.


On 30/03/2022 11:26, Fatih USTA wrote:
> If you need IPS and high performance you can use AF_PACKET. (For input 
> and output interface. This feature works like a bridge.) AF_PACKET 
> works with multi-threaded.
>
> If you are going to analyze passively (pcap) for more than one 
> network, you should run separate snort for each interface. (If you 
> want to block, snortsum can be used)
>
> In addition, if you want to use the networks by separating them from 
> each other with rules;
> Create dummy interface for each snort.(ip link add name snort1 type 
> dummy)
> Then create qdisc with the TC command and mirror the traffic to this 
> dummy interface. You can match networks by using TC command and ipset 
> at the same time.
> Run snort for the dummy interface (snort1, snort2)
>
> https://man7.org/linux/man-pages/man8/tc-mirred.8.html
> https://man7.org/linux/man-pages/man8/tc-ematch.8.html
>
> Fatih USTA
>
> On 30.03.2022 12:40, Andrew Welham wrote:
>>
>> Hi,
>>
>> Shame i'm trying to route on a new 1GB internet connection with major 
>> performance issues in snort
>> I did have a thought though,
>> If i have multiple networks, some with internet facing servers. These 
>> obviously need IPS in both directions.
>>
>> For clients (pcs) as there are no inbound connections connection, is 
>> it a reasonable options to only test outbound traffic, to catch bad 
>> connection etc, but not inbound, as there are no inbound triggered 
>> connections allowed.
>> This also helps as the performance issues are caused by inbound 
>> traffic to the clients?
>>
>> Thanks
>>
>>
>>
>> On 30/03/2022 08:01, Fatih USTA wrote:
>>> Hi
>>>
>>> Snort3 doesn't support multi thread with nfq mod.
>>>
>>> I asked same question before.
>>>
>>> https://github.com/snort3/snort3/issues/164#issuecomment-804597085
>>>
>>>
>>> Fatih USTA
>>>
>>> On 30.03.2022 09:03, Andrew Welham wrote:
>>>> Dear All,
>>>>
>>>> I'm trying to run snort 3 in multi threaded mode. As i only appear 
>>>> to have a single thread with maxes out at 100% cpu utilisation, 
>>>> when other cores in the servers are not utilised.
>>>> I am running using NFQUEUE as i also have a firewall on the same 
>>>> router.
>>>>
>>>> I added -z 4 to the command i use.
>>>>
>>>> /usr/local/bin/snort -c /usr/local/etc/snort/snort.lua -s 65535 -k 
>>>> none -l /var/log/snort -D -m 0x1b -Q -z 4
>>>>
>>>>
>>>> Although snort launches i get the following errors, and snort while 
>>>> working does not run in multithreaded mode.
>>>>
>>>> nfq DAQ configured to inline.
>>>> initializing daemon mode
>>>> child process is 39280
>>>> Commencing packet processing
>>>> # ++ [0] 0
>>>> ++ [1] 0
>>>> ++ [2] 0
>>>> ++ [3] 0
>>>> Error receiving message from the DAQ instance: nfq_daq_msg_receive: 
>>>> Netlink message processing failed: -1 - Operation not permitted (1)
>>>> -- [1] 0
>>>> Error receiving message from the DAQ instance: nfq_daq_msg_receive: 
>>>> Netlink message processing failed: -1 - Operation not permitted (1)
>>>> Error receiving message from the DAQ instance: nfq_daq_msg_receive: 
>>>> Netlink message processing failed: -1 - Operation not permitted (1)
>>>> -- [3] 0
>>>> -- [2] 0
>>>>
>>>>
>>>> Is it possible to run snort 3 in multi threaded mode with NFQUEUE.
>>>> Have i made some type of config error
>>>>
>>>>
>>>> Many Thanks
>>>> _______________________________________________
>>>> Snort-users mailing list
>>>> [email protected]
>>>> Go to this URL to change user options or unsubscribe:
>>>> https://lists.snort.org/mailman/listinfo/snort-users
>>>>
>>>>     To unsubscribe, send an email to:
>>>>     [email protected]
>>>>
>>>> Please visit http://blog.snort.org to stay current on all the 
>>>> latest Snort news!
>>>>
>>>> Please follow these rules: 
>>>> https://snort.org/faq/what-is-the-mailing-list-etiquette
>>

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette