Suricata

Can you give a bit more background on how you run suri (netmap section from your yaml, commandline) and what your network setup is?

Probably already checked, but when I read packet sizes > mtu, the first thing I think of is offloading like gro. Did you disable these types of offloading?

Victor Julien wrote:

Can you give a bit more background on how you run suri (netmap section from your yaml, commandline) and what your network setup is?

from suricata.yaml:

# IPS Mode Configuration
# Netmap
netmap:
 - interface: default
   threads: auto
   copy-mode: ips
   disable-promisc: no
   checksum-checks: auto
 - interface: igb0
   copy-iface: igb0+
 - interface: igb0+
   copy-iface: igb0

Command Line:

/usr/local/bin/suricata --netmap -D -c /usr/local/etc/suricata/suricata_igb0/suricata.yaml --pidfile /var/run/suricata_igb0.pid

Network Setup:

igb0 is the WAN interface and is configured up with:

 ifconfig igb0 -rxcsum -rxcsum6 -txcsum -txcsum6 -lro -tso -vlanhwtso

output from ifconfig igb0:

 igb0: flags=28943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST,PPROMISC> metric 0 *mtu 1500*
 options=1000b8<VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,NETMAP>

Flow control on all interfaces is disabled.

Using "route get [any WAN/LAN ip]" I see an mtu of 1500 everywhere except on link-local (which shows as 16384).

Probably already checked, but when I read packet sizes > mtu, the first thing I think of is offloading like gro. Did you disable these types of offloading?

I believe so, yes.

This isn't a huge priority. Setting dev.netmap.buf_size higher than the bad pkt reported slot->len will resolve the netmap errors, but I can't figure how and where the slot->len that netmap receives is getting to be greater than 2048 for these users.

As I read source_netmap.c from Suricata moving packets around in copy mode seems to be pretty straight-forward:

else {
        unsigned char *slot_data = (unsigned char *)NETMAP_BUF(txring->tx, ts->buf_idx);
        memcpy(slot_data, GET_PKT_DATA(p), GET_PKT_LEN(p));
        ts->len = GET_PKT_LEN(p);
        ts->flags |= NS_BUF_CHANGED;
    }

Maybe if I ask the question this way: if I have an MTU of 1500 and add an ethernet header of 18? bytes (or 22 for VLANs), then should I be able to set dev.netmap.buf_size=1518 and expect Suricata+Netmap to work if offloading is disabled? Or is Suricata adding data anywhere?

Or maybe asking the question a slightly different way: do we know why the default dev.netmap.buf_size=2048 and not something closer to the typical MTU of 1500? I recognize that's a question for the netmap or FreeBSD team, but I'm trying to get a handle on the general idea.

There have been fixes to Suricata 4.1.x and in the master branch netmap support have been rewritten. Are you still seeing this with 4.1.3 or the master branch?