Suricata

Hi Jason, did you check how this works with the current master? I think the capture methods give better output now if a portion of the commandline is interpreted as bpf.

No, I haven't had a chance to revisit this yet. I am still planning on getting to it. Hopefully in the next week or so.

For af-packet in current master:
jason@dinosaur suri]$ sudo suricata --af-packet=wlp1s0 c suricata.yaml -
[4180] 26/2/2019 - 19:32:37 - (conf-yaml-loader.c:279) <Info> (ConfYamlParse) -- Configuration node 'extended' redefined.
[4180] 26/2/2019 -- 19:32:37 - (suricata.c:1058) <Notice> (LogVersion) -- This is Suricata version 5.0.0-dev (rev d6903e70c)
[4180] 26/2/2019 -- 19:32:37 - (util-ioctl.c:324) <Warning> (SetEthtoolValue) -- [ERRCODE: SC_ERR_SYSCALL(50)] - Failure when trying to set feature via ioctl for 'wlp1s0': Operation not supported (95)
[4180] 26/2/2019 -- 19:32:37 - (tm-threads.c:2157) <Notice> (TmThreadWaitOnThreadInit) -- all 4 packet processing threads, 2 management threads initialized, engine started.
[4181] 26/2/2019 -- 19:32:37 - (source-af-packet.c:2263) <Error> (AFPSetBPFFilter) -- [ERRCODE: SC_ERR_AFP_CREATE(190)] - Failed to compile BPF "-": syntax error in filter expression: syntax error
[4181] 26/2/2019 -- 19:32:37 - (source-af-packet.c:1497) <Error> (ReceiveAFPLoop) -- [ERRCODE: SC_ERR_AFP_CREATE(190)] - Couldn't init AF_PACKET socket, fatal error
[4180] 26/2/2019 -- 19:32:37 - (tm-threads.c:2074) <Error> (TmThreadCheckThreadState) -- [ERRCODE: SC_ERR_FATAL(171)] - thread W#01-wlp1s0 failed

So it looks like this is handled with better logging. I need to set up a pfring box yet to test that.

current pf_ring behavior on master:
sudo suricata --pfring-int=ens3 --pfring-cluster-id=99 --pfring-cluster-type=cluster_flow -c ./suricata.yaml - -vv

[4025] 12/3/2019 -- 14:09:26 - (util-ioctl.c:442) <Perf> (DisableIfaceOffloadingLinux) -- ens3: disabling gro offloading
[4025] 12/3/2019 -- 14:09:26 - (util-ioctl.c:449) <Perf> (DisableIfaceOffloadingLinux) -- ens3: disabling tso offloading
[4025] 12/3/2019 -- 14:09:26 - (util-ioctl.c:456) <Perf> (DisableIfaceOffloadingLinux) -- ens3: disabling gso offloading
[4025] 12/3/2019 -- 14:09:26 - (util-ioctl.c:463) <Perf> (DisableIfaceOffloadingLinux) -- ens3: disabling sg offloading
[4025] 12/3/2019 -- 14:09:26 - (util-runmodes.c:297) <Info> (RunModeSetLiveCaptureWorkersForDevice) -- Going to use 1 thread(s)
[4026] 12/3/2019 -- 14:09:26 - (source-pfring.c:528) <Perf> (ReceivePfringThreadInit) -- Enabling zero-copy for ens3
[4026] 12/3/2019 -- 14:09:26 - (source-pfring.c:604) <Perf> (ReceivePfringThreadInit) -- (W#01-ens3) Using PF_RING v.7.5.0, interface ens3, cluster-id 99, single-pfring-thread
[4026] 12/3/2019 -- 14:09:26 - (source-pfring.c:618) <Info> (ReceivePfringThreadInit) -- Set PF_RING bpf filter "-" failed.
[4025] 12/3/2019 -- 14:09:26 - (runmode-pfring.c:541) <Info> (RunModeIdsPfringWorkers) -- RunModeIdsPfringWorkers initialised
[4025] 12/3/2019 -- 14:09:26 - (util-conf.c:115) <Info> (ConfUnixSocketIsEnable) -- Running in live mode, activating unix socket
[4025] 12/3/2019 -- 14:09:26 - (unix-manager.c:131) <Info> (UnixNew) -- Using unix socket file '/var/run/suricata/suricata-command.socket'
[4025] 12/3/2019 -- 14:09:26 - (tm-threads.c:2157) <Notice> (TmThreadWaitOnThreadInit) -- all 1 packet processing threads, 4 management threads initialized, engine started.

So the behavior is a little different, when using af-packet logs an error and fails to load, pfring logs an error but loads suricata.

Is that the expected behavior?

I think it should be consistent for all capture methods, and I'd like this to be an error instead of a warning disguised as a 'info' message. Are you interested in updating the pfring code?

Yeah, I can take a look.

JT