0

I am using Suricata IDS in NFQUEUE mode:

iptables -A PREROUTING -m mark ! --mark 0x1/0x1 -m comment --comment "Suricata NFQUEUE handler" -j NFQUEUE --queue-num 0 --queue-bypass

Today server port became unavailable for some time, and this messages appeared in kern.log:

18:51:53 up02-lb kernel: nf_queue: full at 4096 entries, dropping packets(s)

How can I increase it? It is not controlled by any of sysctl parameters and I can not find it in /proc/net/netfilter/nfnetlink_queue. I increased max-pending-packets in suricata.yaml, but I am not sure this helps.

1

This value is set by Suricata. It uses "max-pending-packets" from your suricata.yaml and multiplies it by 4

int r = NFQInitThread(ntv, (max_pending_packets * NFQ_BURST_FACTOR));
if (r != TM_ECODE_OK) {

Where NFQ_BURST_FACTOR is 4. See https://github.com/inliniac/suricata/blob/71a3c4caac22b475c09ee2f082f11d443dc02cc0/src/source-nfq.c#L712

You can increase the value in your suricata.yaml. If you set max-pending-packets to 4096, you should get output similar to:

[6146] 7/6/2016 -- 20:31:12 - <Info> -- binding this thread 0 to queue '0'
[6146] 7/6/2016 -- 20:31:12 - <Info> -- setting queue length to 16384

Another thing you could try is enabling the 'fail open' support. This means that on the kernel side, NFQ is passing packets when Suricata can't keep up. This leads to a security risk though, as some packets won't be inspected.

From the suricata.yaml:

# On linux >= 3.6, you can set the fail-open option to yes to have the kernel
# accept the packet if suricata is not able to keep pace.
nfq:
#  mode: accept
#  repeat-mark: 1
#  repeat-mask: 1
#  route-queue: 2
#  batchcount: 20
#  fail-open: yes

If you uncomment the last open the fail-open support will be enabled.

I definitely recommend increasing the queue length before enabling fail-open though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.