https://inliniac.net/blog/tag/ethtool/ Recent content in Ethtool on Inliniac Hugo en Sat, 29 Mar 2014 22:01:56 +0000 https://inliniac.net/blog/2014/03/30/video-suricata-2-0-installation-and-quick-setup/ Sat, 29 Mar 2014 22:01:56 +0000 https://inliniac.net/blog/2014/03/30/video-suricata-2-0-installation-and-quick-setup/ <p>I&rsquo;ve made a video on installing Suricata 2.0 on Debian Wheezy. The video does the installation, quick setup, ethtool config and shows a simple way to test the IDS.</p> <div style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden;"> <iframe allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen="allowfullscreen" loading="eager" referrerpolicy="strict-origin-when-cross-origin" src="https://www.youtube.com/embed/rodY7A14L2g?autoplay=0&amp;controls=1&amp;end=0&amp;loop=0&amp;mute=0&amp;start=0" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%; border:0;" title="YouTube video"></iframe> </div> <p>It&rsquo;s the first time I&rsquo;ve made such a video. Feedback is welcome.</p> https://inliniac.net/blog/2007/04/20/snort_inline-and-tcp-segmentation-offloading/ Fri, 20 Apr 2007 16:36:55 +0000 https://inliniac.net/blog/2007/04/20/snort_inline-and-tcp-segmentation-offloading/ <p>Since a short while I have a gigabit setup at home. My laptop has a e1000 Intel NIC, my desktop a Broadcom NIC.While playing with Snort_inline and netpipe-tcp, I noticed something odd. I got tcp packets that had the &lsquo;Don&rsquo;t Fragment&rsquo; option set, but were still bigger than the mtu size of the link. Snort_inline read packets of up to 26kb from the queue, and wireshark and tcpdump were seeing the packets as well. This was only for outgoing packets on the e1000 NIC. The receiving pc saw the packets split up in multiple packets that were honoring the mtu size. This got me thinking that some form of offloading must be taking place and indeed this was the case:</p>