Task #3301
open
Research: Failover support within the current IPS implementation
Added by Andreas Herz almost 5 years ago.
Updated almost 5 years ago.
Description
Failover support would make sure that if there are multiple Suricata instances and one of those disappears, the other Suricata IPS instances would 'do the right thing'. What doing the right thing is is an open question. Some of the ideas:
- sync flow table so that flow tracking would stay active
- sync 'drop settings' per flow/host/etc
- sync thresholding
- datasets?
I think one of the first things that needs to be done is analyze how Suricata currently works in a IPS failover case.
Related issues
2 (2 open — 0 closed)
- Description updated (diff)
- Assignee changed from OISF Dev to Community Ticket
Existing fail over solutions may be worth looking into.
CARP is for failover of IP addresses for firewalls. It uses a virtual IP address for the firewall, then when one fails, the spare takes over that IP address. This might be re-useable as is in a IPS setup, especially if routing is used.
But CARP is only for the address redundancy. PF has a tool called "pfsync" (see https://www.openbsd.org/faq/pf/carp.html) that takes care of syncing the firewall state. This is probably a close example to what would be needed between 2 Suricata instances.
I'd also start by the bare minimum, perhaps stuff like datasets could be in a phase 2 on the understanding that failover may not sync all state.
- Parent task deleted (
#3288)
- Related to Task #3288: Suricon 2019 brainstorm added
- Related to Feature #3316: Unix socket: support dumping flow table added
Also available in: Atom
PDF