21. Using Capture Hardware

• 21.1. Endace DAG
• 21.2. Napatech
  • 21.2.1. Contents
  • 21.2.2. Introduction
  • 21.2.3. Package Installation
  • 21.2.4. Suricata Installation
  • 21.2.5. Suricata configuration
  • 21.2.6. Example Configuration - Auto-config without cpu-affinity:
  • 21.2.7. Example Configuration - Auto-config with cpu-affinity:
  • 21.2.8. Example Configuration - Manual Configuration
  • 21.2.9. Bypassing Flows
  • 21.2.10. Inline Operation
  • 21.2.11. Counters
  • 21.2.12. Napatech configuration options:
  • 21.2.13. Support
• 21.3. Myricom
  • 21.3.1. Debug Info
  • 21.3.2. Additional Info
• 21.4. eBPF and XDP
  • 21.4.1. Introduction
    • 21.4.1.1. XDP
  • 21.4.2. Requirements
  • 21.4.3. Prerequisites
    • 21.4.3.1. Disable irqbalance
    • 21.4.3.2. Kernel
    • 21.4.3.3. Clang and dependencies
    • 21.4.3.4. libbpf
  • 21.4.4. Compile and install Suricata
  • 21.4.5. Setup bypass
  • 21.4.6. Setup eBPF filter
  • 21.4.7. Setup eBPF bypass
  • 21.4.8. Setup eBPF load balancing
  • 21.4.9. Setup XDP bypass
    • 21.4.9.1. Intel NIC setup
    • 21.4.9.2. Disable any NIC offloading
    • 21.4.9.3. Balance as much as you can
    • 21.4.9.4. The XDP CPU redirect case
    • 21.4.9.5. Start Suricata with XDP
  • 21.4.10. Pinned maps usage
  • 21.4.11. XDP and pinned-maps
    • 21.4.11.1. Pinned maps and eBPF filter
  • 21.4.12. Hardware bypass with Netronome
  • 21.4.13. Getting live info about bypass
• 21.5. Netmap
  • 21.5.1. Compiling Suricata
    • 21.5.1.1. FreeBSD
    • 21.5.1.2. Linux
  • 21.5.2. Starting Suricata
    • 21.5.2.1. IDS
    • 21.5.2.2. IPS
  • 21.5.3. Advanced setups
  • 21.5.4. lb (load balance)
    • 21.5.4.1. FreeBSD 11
    • 21.5.4.2. Single NIC
    • 21.5.4.3. VALE switches
  • 21.5.5. Inline IDS
• 21.6. AF_XDP
  • 21.6.1. Compiling Suricata
    • 21.6.1.1. Linux
  • 21.6.2. Starting Suricata
    • 21.6.2.1. IDS
  • 21.6.3. AF_XDP Configuration
  • 21.6.4. Advanced setup
    • 21.6.4.1. force-xdp-mode
    • 21.6.4.2. force-bind-mode
    • 21.6.4.3. mem-unaligned
    • 21.6.4.4. enable-busy-poll
    • 21.6.4.5. busy-poll-time
    • 21.6.4.6. busy-poll-budget
    • 21.6.4.7. Linux tunables
  • 21.6.5. Hardware setup
    • 21.6.5.1. Intel NIC setup
    • 21.6.5.2. Disable any NIC offloading
    • 21.6.5.3. Balance as much as you can
• 21.7. DPDK
  • 21.7.1. Introduction
  • 21.7.2. Hugepage analysis
  • 21.7.3. Bond interface
  • 21.7.4. Interrupt (power-saving) mode