How to send traffic from p0 and p1 to a Suricata container on a DPU

Infrastructure & Networking BlueField
1

Hi team,

I’m integrating Suricata inside a container on a BlueField DPU and I need advice on the best way to deliver all traffic from p0 and p1 to the container for IDS inspection.

Current setup (summary):

  • DPU: BlueField‑2 (ConnectX‑6 Dx) — I can provide firmware and DOCA versions if needed.

  • On the host/DPU, interfaces p0 and p1 appear (and their representors).

  • I want a container with Suricata to see/analyze all traffic from both interfaces (ingress and egress) with good performance.

Things I’ve considered / tried:

  • Creating an additional port P3 and mapping it to Suricata (does this make sense?).

  • Using SF / representors and OVS and connecting the container.

  • Disabling offloads on the interfaces so Suricata doesn’t lose visibility (is this always necessary?).

Specific questions:

  1. To allow Suricata to see all traffic and achieve good performance in a container on a DPU, do you recommend:

    • exposing representors/PFs and using OVS + forward flows to the container, or

    • creating an additional port like P3 / SF and connecting it directly to the container?

  2. If I go with representors + OVS, what is the recommended pattern to connect Suricata in a container considering performance and Suricata compatibility?

  3. Are there special BF/MLX5/DOCA settings I should enable/disable (e.g., PORT_OWNER_*, offloads, XDP, tc offload) to ensure Suricata does not miss packets or metadata?

  4. Any known limitations when running Suricata in a container on a DPU (metadata loss, checksum offload issues, timestamps, hardware steering)?

  5. What logs or outputs would be useful for you to evaluate the situation? (e.g., mlxfwmanager --query, ip link, ovs-vsctl show, dmesg, DOCA/kernel/Suricata versions).

Thanks in advance — any topology examples (commands or diagrams) would be extremely helpful.

2

Hi @tuanama ,

Welcome to NVidia Support Team!

As you said you are using container, it is recommended to use Scalable Function, please refer to BlueField Scalable Function User Guide - NVIDIA Docs

According to your description, I think SF + OVS would be suitable for you request.

I have to say that different scenarios have different specific situations. You can test more in your env to decide which configuration(s) you shoud enable or disable to make it suitable for your scenario .

Best Regards!