19. Using Capture Hardware

• 19.1. AF_PACKET
  • 19.1.1. Introduction
  • 19.1.2. Config Options
    • 19.1.2.1. disable-hwtimestamp
• 19.2. Endace DAG
• 19.3. Napatech
  • 19.3.1. Contents
  • 19.3.2. Introduction
  • 19.3.3. Package Installation
  • 19.3.4. Suricata Installation
  • 19.3.5. Suricata configuration
  • 19.3.6. Example Configuration - Auto-config without cpu-affinity:
  • 19.3.7. Example Configuration - Auto-config with cpu-affinity:
  • 19.3.8. Example Configuration - Manual Configuration
  • 19.3.9. Bypassing Flows
  • 19.3.10. Inline Operation
  • 19.3.11. Counters
  • 19.3.12. Napatech configuration options:
  • 19.3.13. Support
• 19.4. Myricom
  • 19.4.1. Debug Info
  • 19.4.2. Additional Info
• 19.5. eBPF and XDP
  • 19.5.1. Introduction
    • 19.5.1.1. XDP
  • 19.5.2. Requirements
  • 19.5.3. Prerequisites
    • 19.5.3.1. Disable irqbalance
    • 19.5.3.2. Kernel
    • 19.5.3.3. Clang and dependencies
    • 19.5.3.4. libbpf
  • 19.5.4. Compile and install Suricata
  • 19.5.5. Setup bypass
  • 19.5.6. Setup eBPF filter
  • 19.5.7. Setup eBPF bypass
  • 19.5.8. Setup eBPF load balancing
  • 19.5.9. Setup XDP bypass
    • 19.5.9.1. Intel NIC setup
    • 19.5.9.2. Disable any NIC offloading
    • 19.5.9.3. Balance as much as you can
    • 19.5.9.4. The XDP CPU redirect case
    • 19.5.9.5. Start Suricata with XDP
  • 19.5.10. Pinned maps usage
  • 19.5.11. XDP and pinned-maps
    • 19.5.11.1. Pinned maps and eBPF filter
  • 19.5.12. Hardware bypass with Netronome
  • 19.5.13. Getting live info about bypass
• 19.6. Netmap
  • 19.6.1. Compiling Suricata
    • 19.6.1.1. FreeBSD
    • 19.6.1.2. Linux
  • 19.6.2. Starting Suricata
    • 19.6.2.1. IDS
    • 19.6.2.2. IPS
  • 19.6.3. Advanced setups
  • 19.6.4. lb (load balance)
    • 19.6.4.1. FreeBSD 11
    • 19.6.4.2. Single NIC
    • 19.6.4.3. VALE switches
  • 19.6.5. Inline IDS
• 19.7. AF_XDP
  • 19.7.1. Compiling Suricata
    • 19.7.1.1. Linux
  • 19.7.2. Starting Suricata
    • 19.7.2.1. IDS
  • 19.7.3. AF_XDP Configuration
  • 19.7.4. Advanced setup
    • 19.7.4.1. force-xdp-mode
    • 19.7.4.2. force-bind-mode
    • 19.7.4.3. mem-unaligned
    • 19.7.4.4. enable-busy-poll
    • 19.7.4.5. busy-poll-time
    • 19.7.4.6. busy-poll-budget
    • 19.7.4.7. Linux tunables
  • 19.7.5. Hardware setup
    • 19.7.5.1. Intel NIC setup
    • 19.7.5.2. Disable any NIC offloading
    • 19.7.5.3. Balance as much as you can
• 19.8. DPDK
  • 19.8.1. Introduction
  • 19.8.2. Hugepage analysis
  • 19.8.3. Bond interface
  • 19.8.4. Interrupt (power-saving) mode
  • 19.8.5. Automatic interface configuration
  • 19.8.6. Link State Change timeout
  • 19.8.7. Encapsulation stripping
• 19.9. PCAP File Reading
  • 19.9.1. Configuration
  • 19.9.2. Buffer Size
  • 19.9.3. Directory-related options
  • 19.9.4. Other options