After installing Suricata, some fine tuning of the network interface(s) used in the traffic capture is required to ensure every ounce of performance is extracted from the new IDPS installation. Those configurations need to be persisted when the system is power cycled. To do that on a Enterprise Linux based OS (e.g. RedHat, CentOS, Fedora, etc.) one can leverage the
This script is called per interface by the network configuration utility when the network is up and running (at least when using a static configuration). The performance oriented configurations that are usually needed are:
The kernel network stack can also be tuned using the
/sbin/ifup-local script, however the recommended approach is to use a file under the
/etc/sysctl.d/ directory instead. The
ifup-local file doesn’t usually exist, so it needs to be created and made executable.
Follows the contents of the script that I use.
After a reboot, to verify if the configurations have been applied correctly (the system used in this example as 8 CPU’s) issue the following commands.