OPNsense
  • Home
  • Help
  • Search
  • Login
  • Register

  • OPNsense Forum »
  • Archive »
  • 17.7 Legacy Series »
  • Suricata not catching packets on PPPoE WAN
« previous next »
  • Print
Pages: [1]

Author Topic: Suricata not catching packets on PPPoE WAN  (Read 3857 times)

guest16807

  • Guest
Suricata not catching packets on PPPoE WAN
« on: November 23, 2017, 10:31:20 pm »
Hi.
I've setup fresh OPNSense box in Proxmox enviroment.

First problem (in the test phase) was the virtio net driver - it was freezing whole virtual machine when enabling IPS in services. Quicly found on this forum that virtio isn't the best option for Suricata and switched to E1000 driver.

When I went to "production" I've passed thru Intel 82576 as WAN port and set PPPoE creditencials.
Everything works great except Suricata. It seems, that Suricata can't catch packets on PPPoE interface.
In suricata.log I see something like this (and nothing else):
Code: [Select]
23/11/2017 -- 21:23:21 - <Notice> - Signal Received.  Stopping engine.
23/11/2017 -- 21:23:21 - <Notice> - Stats for 'pppoe1':  pkts: 0, drop: 0 (nan%), invalid chksum: 0
23/11/2017 -- 21:23:21 - <Notice> - Stats for 'pppoe1+':  pkts: 0, drop: 0 (nan%), invalid chksum: 0
23/11/2017 -- 21:25:04 - <Notice> - This is Suricata version 4.0.1 RELEASE
23/11/2017 -- 21:25:04 - <Notice> - all 2 packet processing threads, 4 management threads initialized, engine started.
I've found old thread in legacy subforum with familiar issue but without any solution (but that was v17.1 with 3.x Suricata installation).

Is there any chance to use IPS on PPPoE WAN interface?


Logged

nspritz

  • Newbie
  • *
  • Posts: 14
  • Karma: 4
    • View Profile
Re: Suricata not catching packets on PPPoE WAN
« Reply #1 on: November 28, 2017, 02:15:32 pm »
Same behavior on a Qotom-Q355 appliance using Intel I211-AT (igb2 driver).
Would this be a hardware limitation or just the nature of PPPoE?
Logged

franco

  • Administrator
  • Hero Member
  • *****
  • Posts: 13629
  • Karma: 1173
    • View Profile
Re: Suricata not catching packets on PPPoE WAN
« Reply #2 on: November 30, 2017, 03:26:24 pm »
This is a known limitation of the IPS mode, but not IDS. We suspect somewhere in the FreeBSD kernel:

https://redmine.openinfosecfoundation.org/issues/1925

We've been through some debugging sessions despite the lack of feedback on that particular ticket, but have found no conclusive answer as to if and how it could be fixed.


Cheers,
Franco
Logged

chemlud

  • Hero Member
  • *****
  • Posts: 2037
  • Karma: 93
    • View Profile
Re: Suricata not catching packets on PPPoE WAN
« Reply #3 on: November 30, 2017, 04:40:13 pm »
@Franco, this ticket is meanwhile closed. Will this ever be functional? Would be crucial to know if there is any IDS/IPS possible with PPPoE in the future. No way to setup Snort on OPNsense, I guess?
Logged
kind regards
chemlud
____
"The price of reliability is the pursuit of the utmost simplicity."
C.A.R. Hoare

AdSchellevis

  • Administrator
  • Hero Member
  • *****
  • Posts: 849
  • Karma: 163
    • View Profile
Re: Suricata not catching packets on PPPoE WAN
« Reply #4 on: November 30, 2017, 08:20:32 pm »
It's a limitation of netmap,  neither suricata or snort (by my knowledge) are capable of decoding the ppp packets it will receive on the physical interface. IDS mode captures the packets on the virtual interface (after decapsulation).

If you're not running any services on the network interface which is encapsulated, you could consider enabling ips on your internal interfaces (which also matches most of the rules better, because of nat reasons).
A solution with divert sockets might work in theory, but is pretty cpu intensive.

Cheers,

Ad
Logged

  • Print
Pages: [1]
« previous next »
  • OPNsense Forum »
  • Archive »
  • 17.7 Legacy Series »
  • Suricata not catching packets on PPPoE WAN
 

OPNsense is an OSS project © Deciso B.V. 2015 - 2023 All rights reserved
  • SMF 2.0.19 | SMF © 2021, Simple Machines
    Privacy Policy
    | XHTML | RSS | WAP2