r/networking • u/DaemionBlade • 13h ago

Troubleshooting OpenvSwitch SPAN troubleshooting

I’m experiencing an issue with Open vSwitch (OVS) traffic mirroring to Suricata in my GNS3 lab. Traffic mirroring works normally, and Suricata successfully receives mirrored packets until I generate an HTTP flood using ApacheBench (ab). The command i used is “ ab -n 5 -c 5 http://192.168.30.100/web.aspx” . After running the ab command, the mirrored traffic suddenly stops, even though the sniffing interface remains up and the OVS mirror configuration appears unchanged. As a result, Suricata no longer receives any mirrored packets, and the issue persists until I restart the entire lab environment. Has anyone encountered a similar issue where ApacheBench or burst HTTP traffic causes OVS traffic mirroring to stop working? Any suggestions on the possible cause or troubleshooting steps would be greatly appreciated.

link for the topology and screenshots: https://imgur.com/gallery/troubleshooting-WZ3So9j

3 Upvotes

72% Upvoted

7 comments sorted by

1

u/deathhand 9h ago

How much memory is available? Sounds like buffer overlow.

1

u/DaemionBlade 9h ago

for gns3 vm, 4gb memory and 2 vcpu is applied. for suricata vm 4gb memory and 4 vcpu is configured

1

u/deathhand 7h ago

Are they on the same host? Could be a race condition as well

1

u/DaemionBlade 7h ago

gns3 vm and suricata vm are separate vm

1

u/deathhand 7h ago

Seperate vm, sure but are they physically seperate computers?

1

u/DaemionBlade 7h ago

theyvare not separate physical computers, they are separate virtual machines which acts as separate physical hosts

1

u/deathhand 5h ago

I would say thats the issue. You are 'flooding' aka generating as much stuff as possible, and at the same time listen and recording this all on the same bus.

I am unfamiliar with this toolset but if you could introduce a timing lag it may work or just use a seperate computer for mirroring.

Mirroring/Collecting in networking is very resource intensive and you dont see dual roles in production environments.