From: Eric Leblond <eric@regit.org>
Date: Sun, 29 Sep 2019 08:17:04 +0000 (+0200)
Subject: doc: information about scaling AF_PACKET IPS mode
X-Git-Tag: suricata-5.0.0~105
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=82eb669205ce7d845d2ed07466515196de467fab;p=thirdparty%2Fsuricata.git

doc: information about scaling AF_PACKET IPS mode
---

diff --git a/doc/userguide/capture-hardware/ebpf-xdp.rst b/doc/userguide/capture-hardware/ebpf-xdp.rst
index 0b67d8c35a..5654868472 100644
--- a/doc/userguide/capture-hardware/ebpf-xdp.rst
+++ b/doc/userguide/capture-hardware/ebpf-xdp.rst
@@ -1,3 +1,5 @@
+.. _ebpf-xdp:
+
 eBPF and XDP
 ============
 
diff --git a/doc/userguide/setting-up-ipsinline-for-linux.rst b/doc/userguide/setting-up-ipsinline-for-linux.rst
index f4dfeb1f5f..f9e1ae6249 100644
--- a/doc/userguide/setting-up-ipsinline-for-linux.rst
+++ b/doc/userguide/setting-up-ipsinline-for-linux.rst
@@ -183,3 +183,31 @@ The `copy-mode` variable can take the following values:
 
 - `ips`: the drop keyword is honored and matching packets are dropped.
 - `tap`: no drop occurs, Suricata acts as a bridge
+
+Some specific care must be taken to scale the capture method on multiple threads. As we can't use defrag that will generate too big frames, the in kernel load balancing will not be correct: the IP-only fragment will not reach the same thread as the full featured packet of the same flow because the port information will not be present.
+
+A solution is to use eBPF load balancing to get an IP pair load balancing that will be fragmentation resistant. The AF_PACKET IPS Configuration using multiple threads and eBPF load balancing looks like the following: ::
+
+ af-packet:
+   - interface: eth0
+     threads: 16
+     defrag: no
+     cluster-type: cluster_ebpf
+     ebpf-lb-file: /usr/libexec/suricata/ebpf/lb.bpf
+     cluster-id: 98
+     copy-mode: ips
+     copy-iface: eth1
+     buffer-size: 64535
+     use-mmap: yes
+   - interface: eth1
+     threads: 16
+     cluster-id: 97
+     defrag: no
+     cluster-type: cluster_ebpf
+     ebpf-lb-file: /usr/libexec/suricata/ebpf/lb.bpf
+     copy-mode: ips
+     copy-iface: eth0
+     buffer-size: 64535
+     use-mmap: yes
+
+The eBPF file `/usr/libexec/suricata/ebpf/lb.bpf` may not be present on disk. See :ref:`ebpf-xdp` for more information.