Netmap emulation mode software#

It is a software construct, and is quite slow to process traffic. First, if you pass netmap the VLAN interface name, it will actually create an emulated netmap adapter for the interface (because the VLAN interface itself is actually a virtual device). When running Suricata on a VLAN interface with Inline IPS Mode using the netmap device, the VLAN's parent interface should be passed to Suricata (and thus eventually to netmap).

Netmap emulation mode code#

And the OPNsense guys have also put the updated netmap code into their Suricata development branch.īut the new netmap code in the Suricata binary exposed a bug in the Suricata package GUI code. I have backported this new netmap code into the Suricata 6.0.3 binary currently used in pfSense. This new code is slated to be introduced upstream in Suricata 7.0 due for release shortly. So traffic loads can be spread across multiple threads running on multiple cores when using Inline IPS Mode. With the new netmap code, Suricata can now create a separate thread to service each NIC queue (or ring), and those separate threads have a matching host stack queue (ring) for reading and writing data.

You can now tell netmap to open as many host stack rings (or queues) as the physical NIC exposes. This new API version exposes multiple host stack rings when opening the kernel end of a network connection (a.ka. Recently the netmap code in Suricata was overhauled so that it supports the latest version 14 of the NETMAP_API. So no matter how many CPU cores you had in your box, Suricata would only use one of them to process the traffic when using netmap with Inline IPS operation. That limited throughput as the single ring meant all traffic was restricted to processing on a single CPU core. The older netmap code that was in Suricata only opened a single host stack ring. So for example, if your VLAN interface was vmx0.10 (which would be a VLAN interface with the assigned VLAN ID '10'), you should actually run the netmap device on the parent interface (so that would be vmx0 instead of vmx0.10). When you use Inline IPS Mode on a VLAN-enabled interface, then you need to run the IDS/IPS engine on the parent interface of the VLAN.

It does not process VLAN tags, nor does it work properly with traffic shapers or limiters. Netmap enables a userland application such as Suricata or Snort to intercept network traffic, inspect that traffic and compare it against the IDS/IPS rule signatures, and then drop packets that match a DROP rule.īut the netmap device currently has some limitations. The Inline IPS Mode of blocking used in both the Suricata and Snort packages takes advantage of the netmap kernel device to intercept packets as they flow between the kernel's network stack and the physical NIC hardware driver.