Setting up (configuring) the right MTU (maximum transmission unit) size when running Suricata IDS/IPS.
Sometimes you can end up in a situation as follows :
capture.kernel_packets | AFPacketeth12 | 1143428204
decoder.pkts | AFPacketeth12 | 1143428143
decoder.invalid | AFPacketeth12 | 416889536
a whole lot of decoder.invalid. Not good. What could be the reason for that? One thing you should check right away is the MTU of the traffic that is being mirrored.
What does it mean? Well there is the MTU that you set up on the server that you run Suricata on and there is the MTU that is present in the "mirrored" traffic.
What is the difference?Why should it matter?
It matters because if not set correct it will result in a lot of decoder.invalids (dropped by Suricata) and you will be missing on a lot of traffic inspection.
Example: if on the sniffing interface that you run Suricata on has a MTU set as 1500 and in the traffic that you mirror you have jumbo frames (MTU 9000) - most likely your decoder.invalids will show a whole lotta love in your stats.log.
How can you adjust the MTU on the interface (NIC) ? (example)
First a have look what is the current value:
ifconfig eth0then adjust it
ifconfig eth0 mtu 1514
By the way - what could be the max size of the MTU (and what sizes there are in general) -
(short answer - 9216)
This is the easy part :). There are situations where you do not know what is the MTU of the "mirrored" traffic. There is a few ways to find this - ask the network team/guy, make a phone call or two, start manually testing and setting it on the NIC to find a middle ground ....however you can also make use of the procedure shown below (in order to get the byte size of the MTU):
On your Server/Sensor
1)
Stop Suricata.
2)
Change the MTU to 9216
(the interface that Suri is sniffing on)
example - ifconfig eth0 mtu 9216(non boot persistent)
3)
install tcpstat - if you do not have it
apt-get install tcpstat
5)
run the following (substitute the interface name with yours - that Suri is sniffing on)
tcpstat -i eth0 -l -o "Time:%S\tn=%n\tavg=%a\tstddev=%d\tbps=%b\tMaxPacketSize=%M\n" 5
6)
Give it a minute or two
If there are Jumbo frames you should see that in the output (something like) -
"MaxPacketSize=9000", if not you should see whatever the max size is.
7)
Adjust your interface MTU accordingly - the one that Suri is sniffing
on. -> Start Suri
Give it a minute or two
If there are Jumbo frames you should see that in the output (something like) -
"MaxPacketSize=9000", if not you should see whatever the max size is.
7)
Adjust your interface MTU accordingly - the one that Suri is sniffing
on. -> Start Suri
8)
Let it run for a while - lets say 1 hr. Have a look at the decoder.invalid stats in stats.log
NOTE: Do NOT just set the MTU to 9216 directly ("just to be on the safe side"). Only set it that high if needed !!
NOTE: This example below is not using the "-l" option of tcpstat as denoted in point 5) above - look at man tcpstat for more info
(tested on Ubuntu/Debian)
That's all ....feedback welcome.
