From owner-freebsd-net@freebsd.org  Wed Jul  1 16:06:16 2015
Return-Path: <owner-freebsd-net@freebsd.org>
Delivered-To: freebsd-net@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id CF98A991FC8
 for <freebsd-net@mailman.ysv.freebsd.org>;
 Wed,  1 Jul 2015 16:06:16 +0000 (UTC)
 (envelope-from oliver@watershed.co.uk)
Received: from babbage.watershed.co.uk (babbage.watershed.co.uk
 [195.10.250.253])
 (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 6F7F310C0
 for <freebsd-net@freebsd.org>; Wed,  1 Jul 2015 16:06:15 +0000 (UTC)
 (envelope-from oliver@watershed.co.uk)
Received: from oliver.local.watershed.co.uk (Oliver.local.watershed.co.uk
 [192.168.128.78]) (authenticated bits=0)
 by babbage.watershed.co.uk (8.15.1/8.15.1) with ESMTPSA id t61G69Gl006407
 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT)
 for <freebsd-net@freebsd.org>; Wed, 1 Jul 2015 17:06:10 +0100 (BST)
 (envelope-from oliver@watershed.co.uk)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=watershed.co.uk;
 s=main; t=1435766770;
 bh=ixKvh6Bv4UxIlrccfXWxNLn4QNMxoiwLreX/islnwVc=;
 h=Subject:From:In-Reply-To:Date:References:To;
 b=4tldAY0n6zF1uPRb7FLBW3it5gms4tuAhrjgPWYLA5Hr7G5BuzOZ1xNTP5446SCuG
 qOtkU3ByXtz1CSmlxvLwBehoSLXGJVP1ixMsW/o9mnhM3f2SOd1bVgiB9mnW4YxUVk
 +Xp1rDViD7GuXnDcDcYHvu4qrvM+5M7QXDbcNBaSGC/kunV+KhYJ0N5y1UJDAgCwUK
 MQy+8cd0Y+ryiXE5Bvhlr4VeG+8ui30j/e+2px4Eb7t9OXmILKt0p8xSO9Aly3giNK
 lOIZokfYfQqP1rW2J7JfSNNFGZ0PxEKgOGJzqmoGCpqU3n6HPATBmUFTAzkV/NitDD
 2yZE6P2Zlp9AA==
Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\))
Subject: Re: IPFW divert and suricata
From: Oliver Humpage <oliver@watershed.co.uk>
In-Reply-To: <CA+hQ2+jZGbBMT4pD8GD4_4nuX9jEE4NCOSykmydtYCgy=vK-sA@mail.gmail.com>
Date: Wed, 1 Jul 2015 17:06:09 +0100
Content-Transfer-Encoding: quoted-printable
Message-Id: <FBDE2520-9C54-48A4-BC61-BBFA447A8E56@watershed.co.uk>
References: <D632FEB9-4C62-451E-B2F6-333B7EDAE7C9@watershed.co.uk>
 <CA+hQ2+jZGbBMT4pD8GD4_4nuX9jEE4NCOSykmydtYCgy=vK-sA@mail.gmail.com>
To: "freebsd-net@freebsd.org" <freebsd-net@freebsd.org>
X-Mailer: Apple Mail (2.1510)
X-Virus-Scanned: by Sophos
X-Scanned-By: MIMEDefang 2.74 on 195.10.250.253
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net/>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 01 Jul 2015 16:06:16 -0000


On 1 Jul 2015, at 15:31, Luigi Rizzo <rizzo@iet.unipi.it> wrote:

> For the latter two, you might be better off using netmap
> on vmxnet3 (in emulated mode, also disabling offloads),
> and if i remember well a couple of years ago there were
> efforts to use =E2=80=8Bsuricata on top of netmap.
> Worst case, you can just use the netmap-enabled libpcap.

Looks like netmap support has been finished and will be in version 2.1 =
of Suricata, so that's promising.

For now I'll try turning off all the hardware offloads and see what =
happens.

> 3. divert probably loses important context on the packets
>    (e.g. incoming or outgoing interface) so when traffic is
>    reinjected bad things occur

Would specifying a reinject rule (eg a "pass all") help, do you think? =
And/or having different divert rules for incoming/outgoing? I had =
assumed it wouldn't, but I'm not an expert.

Many thanks for replying,

Oliver.=