mirror of
https://github.com/ParrotXray/Mantis.git
synced 2026-08-24 19:50:28 +09:00
ParrotXray
40d420a0d7
* wip * refactor: replace xsk_cpu_base with xsk_cpu_set for round-robin core distribution * refactor: replace native vectorscan rule engine with Suricata daemon mode * docs: overhaul TODO, research state, and CLAUDE.md post-Suricata refactor
44 lines
1.8 KiB
TOML
44 lines
1.8 KiB
TOML
[Config]
|
|
ingress_ifname = "enp4s0f1" # Ingress NIC Name
|
|
egress_ifname = "enp4s0f0" # Egress NIC Name
|
|
geoip_db_name = "GeoLite2-City.mmdb"
|
|
deep_autoencoder_name = "deep_autoencoder.onnx"
|
|
models_config_name = "inference_config.json"
|
|
|
|
# NIC Combined Queue Count (ethtool -l <NIC>)
|
|
# If you will edit this, please enter ethtool -L <NIC> combined <combined number> at System Terminal.
|
|
# Then change this item.
|
|
combined_queue_count = 8
|
|
channel_size = 4096
|
|
fill_queue_size = 4096 # Umem Used (Should not modify)
|
|
comp_queue_size = 4096 # Umem Used (Should not modify)
|
|
tx_queue_size = 4096 # Umem Used (Should not modify)
|
|
rx_queue_size = 4096 # Umem Used (Should not modify)
|
|
frame_size = 4096 # Umem Used (Should not modify)
|
|
frame_count = 4096 # Umem Used (Should not modify)
|
|
http_server_bind_port = 8080 # Http Server Listen Port
|
|
refresh_interval = 5 # Statistics Refresh Time
|
|
|
|
max_concurrent_flows = 10000 # track up to N concurrent flows
|
|
inference_interval_secs = 5 # run ML inference every N seconds
|
|
aggregator_window_secs = 30
|
|
inference_batch_size = 200
|
|
flow_timeout_us = 60_000_000
|
|
|
|
traffic_logging_mode = false # when true, disables ML inference and records packets to CSV
|
|
traffic_log_csv_path = "traffic_log.csv"
|
|
|
|
# tls_keylog_path = "/tmp/tls_keys.log" # NSS key log file for TLS decryption (SSLKEYLOGFILE)
|
|
|
|
# CPU affinity (Linux only). Uncomment and tune for your hardware.
|
|
# Distribute XSK packet threads across a core range [start, end] (inclusive).
|
|
# Threads are assigned round-robin: core = start + (queue_id % (end - start + 1)).
|
|
xsk_cpu_set = [0, 3]
|
|
|
|
# Pin ML inference (ONNX spawn_blocking) to this core.
|
|
ml_cpu = 7
|
|
|
|
ae_threshold_method = "94"
|
|
|
|
# Suricata daemon mode. Remove or comment out to disable the rule engine.
|
|
suricata_name = "suricata.yaml" |