Virtual Testbed

So I've found it necessary to test IDS that's currently under development on multiple linux systems.. continuously.

So I will ofcourse be shamelessly shilling for VirtualBox, even though they're controlled by oracle now... mixed feelings aside, it still beats vmware for a desktop solution... and setting up snapshots of clean installs of various popular linux distributions.

So far I've got my little virtual network running CentOS, Debian, ubuntu, Fedora, and RHEL.. since we mostly support apt/yum systems so far.

Initial observations: CentOS and RHEL, obviously almost identical.. Debian, not that far off from CentOS, strangely... and everything works just like it should. Fedora and Ubuntu are a whole different world at times, they don't play by the same rules as their metaphorical parents and so far have been where I've spent the most time trying to get things to work.

Any others I should add to this test setup?

vmalloc and pfring

Just incase anyone else out there is playing with pfring dependent systems... you might run into a condition where you try to spawn more pfring threads than the running system has allocated memory to support (side note, when things randomly fail for no good reason... checking dmesg should be your first course of action).

Anyway, you can set the vmalloc size as a boot parameter in grub... and if you want a fancy way of warning users if this problem may apply to them:

if [ `cat /proc/cpuinfo |grep processor|awk '{print $3}'` -gt 4 ] && [ `cat /proc/meminfo | grep VmallocTotal|awk '{print $2}'` -lt 262144 ];then
    echo "Your current Vmalloc value may be insufficient to handle the number of pf_ring threads your processor is capable of. Please consider settting vmalloc=256M as a kernel boot parameter to fix this"
fi