Created attachment 174110 [details] multiple pcap devices patch Hello, I made a modification to the rc script in order to add support for listening on multiple interfaces with Suricata from ports. I'll appreciate it if you accept the patch since it does make sense in many cases to listen on multiple interfaces. Thanks
After that you'll be able to: suricata_interface="xn0 xn1 xn2" in /etc/rc.conf instead of just suricata_interface="xn0"
Thank you for the submission Mohammad. I'll put this through QA and look at landing it shortly if it passes
Created attachment 174111 [details] enables multiple interface with netmap Enables multiple interface with netmap (includes the last patch): suricata_enable="YES" suricata_interface="xn0 xn1" suricata_netmap="YES" suricata_flags="-D -v"
Created attachment 174112 [details] Enables multiple interfaces Enables multiple interface with netmap and supress pcap warning without netmap (includes the last two patch): suricata_enable="YES" suricata_interface="xn0 xn1" suricata_pcap="YES" suricata_flags="-D -v"
@Mohammed please 'obsolete' previous versions of patches if the new version replaces them. This can be done via Attachment -> Details -> Edit Details -> [x] Obsolete
And if you could add a comment itemizing all changes in final version of the patch that would be great.
@Kubilay Thank you so much for the hints. I did not obsolete the older one because I was not sure if the maintainer accepts all the items. These are the items that patch implements: 1. Allows listening on multiple interfaces using suricata_interface in /etc/rc.conf. 2. Allows listening on multiple interfaces using suricata_interface when netmap option is enabled. (both suricata_interface and suricata_netmap should be set) 3. Allows listening on multiple interfaces using suricata_interface but suppresses the Suricata warning by adding a new option in /etc/rc.conf: suricata_pcap="YES"
Hi Mohammad, $suricata_pcap is a cool addition to mute the "faster capture method available" warning! Having it documented on top would be advisable. Cheers, Franco
Any news here? Cheers, Franco
Hi, Can we please get this in? Want me to provide a final patch? Thanks, Franco
This should be closed. Cheers, Franco