Actions
Bug #1078
closed'Not" operator (!) in Variable causes extremely slow loading of Suricata
Affected Versions:
Effort:
Difficulty:
Label:
Description
I'm running Suricata 1.4.1 on FreeBSD. I have encountered an issue when modifying the
HOME_NET variable if I want to exclude a particular IP address from a CIDR
defined network. For example, in HOME_NET I have defined 192.168.0.0/16.
If I want to EXCLUDE the 192.168.14.0 subnet, the documentation I found
said it would noted as follows:
HOME_NET: [192.168.0.0/16,!192.168.14.0/24]
If I DO NOT have the negative in my Suricata.yaml file, it loads in seconds:
-------------------------------------------------------------------- Jan 9 20:33:04 IDS_GW suricata: 9/1/2014 -- 20:33:04 - <Info> - 8641 signatures processed. 704 are IP-only rules, 3688 are inspecting packet payload, 4896 inspect application layer, 0 are decoder event only Jan 9 20:33:04 IDS_GW suricata: 9/1/2014 -- 20:33:04 - <Info> - building signature grouping structure, stage 1: adding signatures to signature source addresses... complete Jan 9 20:33:04 IDS_GW suricata: 9/1/2014 -- 20:33:04 - <Info> - building signature grouping structure, stage 2: building source address list... complete Jan 9 20:33:11 IDS_GW suricata: 9/1/2014 -- 20:33:11 - <Info> - building signature grouping structure, stage 3: building destination address lists... complete ---------------------------------------------------------------------
When I add the negative to the variable, it takes over
40 minutes for Suricata to load and start inspecting traffic.
From the logs, I can tell it hangs after stage 1. Notice the times:
--------------------------------------------------------------------- 9/1/2014 -- 20:23:29 - <Info> - building signature grouping structure, stage 1: adding signatures to signature source addresses... complete 9/1/2014 -- 20:53:39 - <Info> - building signature grouping structure, stage 2: building source address list... complete 9/1/2014 -- 21:10:09 - <Info> - building signature grouping structure, stage 3: building destination address lists... complete ---------------------------------------------------------------------
This bug was independently verified on 2.0Beta2 as well.
Actions