21. Using Capture Hardware

• 21.1. AF_PACKET
  • 21.1.1. Introduction
  • 21.1.2. Config Options
    • 21.1.2.1. disable-hwtimestamp
• 21.2. Endace DAG
• 21.3. Napatech
  • 21.3.1. Contents
  • 21.3.2. Introduction
  • 21.3.3. Package Installation
  • 21.3.4. Suricata Installation
  • 21.3.5. Suricata configuration
  • 21.3.6. Example Configuration - Auto-config without cpu-affinity:
  • 21.3.7. Example Configuration - Auto-config with cpu-affinity:
  • 21.3.8. Example Configuration - Manual Configuration
  • 21.3.9. Bypassing Flows
  • 21.3.10. Inline Operation
  • 21.3.11. Counters
  • 21.3.12. Napatech configuration options:
  • 21.3.13. Support
• 21.4. Myricom
  • 21.4.1. Debug Info
  • 21.4.2. Additional Info
• 21.5. eBPF and XDP
  • 21.5.1. Introduction
    • 21.5.1.1. XDP
  • 21.5.2. Requirements
  • 21.5.3. Prerequisites
    • 21.5.3.1. Disable irqbalance
    • 21.5.3.2. Kernel
    • 21.5.3.3. Clang and dependencies
    • 21.5.3.4. libbpf
  • 21.5.4. Compile and install Suricata
  • 21.5.5. Setup bypass
  • 21.5.6. Setup eBPF filter
  • 21.5.7. Setup eBPF bypass
  • 21.5.8. Setup eBPF load balancing
  • 21.5.9. Setup XDP bypass
    • 21.5.9.1. Intel NIC setup
    • 21.5.9.2. Disable any NIC offloading
    • 21.5.9.3. Balance as much as you can
    • 21.5.9.4. The XDP CPU redirect case
    • 21.5.9.5. Start Suricata with XDP
  • 21.5.10. Pinned maps usage
  • 21.5.11. XDP and pinned-maps
    • 21.5.11.1. Pinned maps and eBPF filter
  • 21.5.12. Hardware bypass with Netronome
  • 21.5.13. Getting live info about bypass
• 21.6. Netmap
  • 21.6.1. Compiling Suricata
    • 21.6.1.1. FreeBSD
    • 21.6.1.2. Linux
  • 21.6.2. Starting Suricata
    • 21.6.2.1. IDS
    • 21.6.2.2. IPS
  • 21.6.3. Advanced setups
  • 21.6.4. lb (load balance)
    • 21.6.4.1. FreeBSD 11
    • 21.6.4.2. Single NIC
    • 21.6.4.3. VALE switches
  • 21.6.5. Inline IDS
• 21.7. AF_XDP
  • 21.7.1. Compiling Suricata
    • 21.7.1.1. Linux
  • 21.7.2. Starting Suricata
    • 21.7.2.1. IDS
  • 21.7.3. AF_XDP Configuration
  • 21.7.4. Advanced setup
    • 21.7.4.1. force-xdp-mode
    • 21.7.4.2. force-bind-mode
    • 21.7.4.3. mem-unaligned
    • 21.7.4.4. enable-busy-poll
    • 21.7.4.5. busy-poll-time
    • 21.7.4.6. busy-poll-budget
    • 21.7.4.7. Linux tunables
  • 21.7.5. Hardware setup
    • 21.7.5.1. Intel NIC setup
    • 21.7.5.2. Disable any NIC offloading
    • 21.7.5.3. Balance as much as you can
• 21.8. DPDK
  • 21.8.1. Introduction
  • 21.8.2. Hugepage analysis
  • 21.8.3. Bond interface
  • 21.8.4. Interrupt (power-saving) mode
• 21.9. PCAP File Reading
  • 21.9.1. Configuration
  • 21.9.2. Directory-related options
  • 21.9.3. Other options