OPNsense Forum
English Forums => Intrusion Detection and Prevention => Topic started by: ArminF on February 25, 2020, 04:26:28 pm
-
Hello,
my box feels boring and has a lot of free memory.
So i thought to give DNS and Suricata more memory.
But there is no system tune option or settings on the GUI.
Is it possible to set more RAM to Suricata?
thanks
armin
-
conf file say
# Flow settings:
# By default, the reserved memory (memcap) for flows is 32MB. This is the limit
# for flow allocation inside the engine. You can change this value to allow
# more memory usage for flows.
# The hash-size determine the size of the hash used to identify flows inside
# the engine, and by default the value is 65536.
# At the startup, the engine can preallocate a number of flows, to get a better
# performance. The number of flows preallocated is 10000 by default.
# emergency-recovery is the percentage of flows that the engine need to
# prune before unsetting the emergency state. The emergency state is activated
# when the memcap limit is reached, allowing to create new flows, but
# prunning them with the emergency timeouts (they are defined below).
# If the memcap is reached, the engine will try to prune flows
# with the default timeouts. If it doens't find a flow to prune, it will set
# the emergency bit and it will try again with more agressive timeouts.
# If that doesn't work, then it will try to kill the last time seen flows
# not in use.
# The memcap can be specified in kb, mb, gb. Just a number indicates it's
# in bytes.
flow:
memcap: 64mb
hash-size: 65536
prealloc: 10000
emergency-recovery: 30
So I guess if you don't see messages on the logs indicating you reached the memcap, then you don't need more RAM. Suricata is probably only CPU intensive, RAM should not be a big issue
-
Siga,
thank you very much.
No i do not see any message of reaching the memcap.
Can you give me the location of the config file?
And would the settings be changed there and would they be reboot consistent?
thank you
A
-
I am not an expert but it should be persistent to reboot, not to an update probably
config file: /usr/local/etc/suricata/suricata.yaml
root@myfw:~ # ps aux | grep suri
root 30263 0.2 3.2 2279032 529764 - Ss 15Feb20 166:52.64 /usr/local/bin/suricata -D --netmap --pidfile /var/run/suricata.pid -c /usr/local/etc/suricata/suricata.yaml
-
Excellent, thank you very much Siga!
-
Just found this as well. As soon as you know what you looking you usually find more :)
https://forum.opnsense.org/index.php?topic=13445.0
-
cool
let us know if you see some benefit, in such case a WUI conf would be nice to have :)
-
So, first attempt was not better than the default.
As you wrote just changing the RAM does not make a difference.
Have to tune on more variables and therefore read more.
Details/Results:
WAN is 250 mbit down / 25 up
CPU intel i3 4100 / 1.8 GHZ
Promiscuous ON
Full Rulesets 47168 set to DROP except P2P
Speedtest default config
Destination Solnet -> 238/24 mbit -> lost 12 mbit
CPU peak max 45%
RAM 1500 MB
Speedtest “tuned” config
Destination Solnet -> 230/24 mbit --> lost 20mbit
CPU peak max 45%
RAM 1500 MB
No RAM change…
back to default settings…
changes:
File Location
/usr/local/opnsense/service/templates/OPNsense/IDS/suricata.yaml
/usr/local/etc/suricata/suricata.yaml
Default Settings
defrag:
memcap: 32mb
hash-size: 65536
trackers: 65535 # number of defragmented flows to follow
max-frags: 65535 # number of fragments to keep (higher than trackers)
prealloc: yes
timeout: 60
flow:
memcap: 64mb
hash-size: 65536
prealloc: 10000
emergency-recovery: 30
stream:
memcap: 32mb
checksum-validation: yes # reject wrong csums
inline: {% if OPNsense.IDS.general.ips|default(“0”) == “1” %}true{% else %}auto{% endif %}
reassembly:
memcap: 128mb
depth: 1mb # reassemble 1mb into a stream
toserver-chunk-size: 2560
toclient-chunk-size: 2560
randomize-chunk-size: yes
Tuned Settings
defrag:
memcap: 512mb
hash-size: 65536
trackers: 65535 # number of defragmented flows to follow
max-frags: 65535 # number of fragments to keep (higher than trackers)
prealloc: yes
timeout: 60
flow:
memcap: 1gb
hash-size: 65536
prealloc: 10000
emergency-recovery: 30
stream:
memcap: 512mb
checksum-validation: yes # reject wrong csums
inline: {% if OPNsense.IDS.general.ips|default(“0”) == “1” %}true{% else %}auto{% endif %}
reassembly:
memcap: 2gb
depth: 2mb # reassemble 2mb into a stream
toserver-chunk-size: 2560
toclient-chunk-size: 2560
randomize-chunk-size: yes