Suricata shows a warning on boot

[fabianfrz]

[fichtner]

What should we do here? Mute the output and potentially remove useful hints as to why Suricata may not work as expected?

[fabianfrz]

I would prefer if It would be changed like described in the warning as it says it is faster and always the fastest option should be used if it does not break anything else ;)

[fichtner]

It complains about not having selected IPS mode, which is a valid configuration option...

[fabianfrz]

Maybe suricata wants to use netmap regardless of running IPS or not. Maybe there is something in the configuration where IPS can be disabled while using netmap.

[fichtner]

PCAP mode is sane and safe. Netmap requires newer hardware. I don't see how we should switch because there is a warning in Suricata. If anything it would help to report this to Suricata as a bug. We set suricata.yaml correctly and still have this warning ;)

[speed47]

I think the warning is not referencing the yaml file but directly the command line. I also noticed I have this warning, and the current command line of my suricata (running in IDS, not IPS) is:

/usr/local/bin/suricata -D -i re0 --pidfile /var/run/suricata.pid -c /usr/local/etc/suricata/suricata.yaml

It seems to be complaining that we didn't explicitely told it to use netmap or pcap, and warns us.
I suppose the /usr/local/etc/rc.d/suricata file should be modified to add the --pcap option when $suricata_netmap = "NO" ?

[fichtner]

@speed47 the launcher script is from FreeBSD ports so ideally this needs to be fixed in coordination with them

[fichtner]

Actually, I think this patch might do the trick coupled with using "$suricata_pcap"

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=212192

[speed47]

Indeed, it should do the trick. I'll test by patching my rc with their diff and report if it works.

[speed47]

I can confirm it works by applying their patch (https://bugs.freebsd.org/bugzilla/attachment.cgi?id=174112&action=diff).
My new command-line, even without defining $suricata_pcap, is:
/usr/local/bin/suricata -D --pcap=re0 --pidfile /var/run/suricata.pid -c /usr/local/etc/suricata/suricata.yaml.

[fichtner]

Thanks for testing 👍 I've prodded the bug report, maybe it can be included in FreeBSD soon. 😊

[fichtner]

still delayed in FreeBSD...

[fichtner]

The suricata rc script is so royally inflexible that it's simply not possible to fix this warning from our end.