snort note - inline mode, packet ack

http://manual.snort.org/node7.html

Packet Acquisition

Snort 2.9 introduces the DAQ, or Data Acquisition library, for packet I/O. The DAQ replaces direct calls to PCAP functions with an abstraction layer that facilitates operation on a variety of hardware and software interfaces without requiring changes to Snort. It is possible to select the DAQ type and mode when invoking Snort to perform PCAP readback or inline operation, etc.

Note:   Some network cards have features named "Large Receive Offload" (lro) and "Generic Receieve Offload" (gro). With these features enabled, the network card performs packet reassembly before they're processed by the kernel. By default, Snort will truncate packets larger than the default snaplen of 1518 bytes. In addition, LRO and GRO may cause issues with Stream5 target-based reassembly. We recommend that you turn off LRO and GRO. On linux systems, you can run: $ ethtool -K eth1 gro off $ ethtool -K eth1 lro off

1.5.2.1 MMAPed pcap

On Linux, a modified version of libpcap is available that implements a shared memory ring buffer. Phil Woods (cpw@lanl.gov) is the current maintainer of the libpcap implementation of the shared memory ring buffer. The shared memory ring buffer libpcap can be downloaded from his website at http://public.lanl.gov/cpw/.

Instead of the normal mechanism of copying the packets from kernel memory into userland memory, by using a shared memory ring buffer, libpcap is able to queue packets into a shared buffer that Snort is able to read directly. This change speeds up Snort by limiting the number of times the packet is copied before Snort gets to perform its detection upon it.

Once Snort linked against the shared memory libpcap, enabling the ring buffer is done via setting the environment variable PCAP_FRAMES. PCAP_FRAMES is the size of the ring buffer. According to Phil, the maximum size is 32768, as this appears to be the maximum number of iovecs the kernel can handle. By using PCAP_FRAMES=max, libpcap will automatically use the most frames possible. On Ethernet, this ends up being 1530 bytes per frame, for a total of around 52 Mbytes of memory for the ring buffer alone.

1.5.3 AFPACKET

afpacket functions similar to the memory mapped pcap DAQ but no external library is required:

    ./snort --daq afpacket -i <device>
            [--daq-var buffer_size_mb=<#MB>]
            [--daq-var debug]

If you want to run afpacket in inline mode, you must set device to one or more interface pairs, where each member of a pair is separated by a single colon and each pair is separated by a double colon like this:

    eth0:eth1

or this:

    eth0:eth1::eth2:eth3

By default, the afpacket DAQ allocates 128MB for packet memory. You can change this with:

    --daq-var buffer_size_mb=<#MB>

Note that the total allocated is actually higher, here's why. Assuming the default packet memory with a snaplen of 1518, the numbers break down like this:

1.5.4 NFQ

NFQ is the new and improved way to process iptables packets:

    ./snort --daq nfq \
        [--daq-var device=<dev>] \
        [--daq-var proto=<proto>] \
        [--daq-var queue=<qid>] \
	[--daq-var queue_len=<qlen>]

    <dev> ::= ip | eth0, etc; default is IP injection
    <proto> ::= ip4 | ip6 | ip*; default is ip4
    <qid> ::= 0..65535; default is 0
    <qlen> ::= 0..65535; default is 0

ref: <An IaaS Cloud For Attack and Defense Experiments>

先安裝以下 library 套件 libcap、
libdnet 、 libnfnetlink 、 libnetfilter_queue 、
libnetfilter_queue-devel、daq,以 "snort -D -Q --daq-
dir=/usr/local/lib --daq nfq --daq-var queue=0 -l
/var/log/snort -c /etc/snort/snort.conf"指令開啟 snort 的
inline mode 且 選 擇 監 控 的 介 面 為 kernel 中 的
nfqueue , 接 著 以 後 snort 會 對 所 有 進 入 kernel
nfqueue 中 的封 包進行 檢測以 及操作