Project

General

Profile

Actions

Bug #1856

closed

PCAP mode device not found

Added by Joakim Wahlgren about 5 years ago. Updated about 5 years ago.

Status:
Closed
Priority:
High
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Hi,

After upgrading from 3.0.1 to 3.1.1 (EL-7) we are getting the following errors when running Suricata in PCAP mode. When we specify the listening interface via the command line (as shown below) the engine starts just fine (Command and logs output provided below).

# suricata --pcap=eth0 -c /etc/suricata/suricata.yaml

(/var/log/suricata/suricata.log)

29/7/2016 -- 12:58:32 - <Warning> - [ERRCODE: SC_ERR_NIC_OFFLOADING(284)] - NIC offloading on eth0: RX SET TX SET. Run: ethtool -K eth0 rx off tx off
29/7/2016 -- 12:58:32 - <Warning> - [ERRCODE: SC_ERR_NIC_OFFLOADING(284)] - NIC offloading on eth0: SG: SET,  GRO: SET, LRO: unset, TSO: SET, GSO: SET. Run: ethtool -K eth0 sg off gro off lro off tso off gso off
29/7/2016 -- 12:58:32 - <Notice> - all 4 packet processing threads, 2 management threads initialized, engine started. 

When not specifying the interface in the command and letting Suricata pick it up from the config file the following happens:

# suricata --pcap -c /etc/suricata/suricata.yaml

(/var/log/suricata/suricata.log)
29/7/2016 -- 12:59:32 - <Error> - [ERRCODE: SC_ERR_PCAP_ACTIVATE_HANDLE(27)] - Couldn't activate the pcap handler, error SIOCGIFHWADDR: No such device
29/7/2016 -- 12:59:32 - <Warning> - [ERRCODE: SC_ERR_NIC_OFFLOADING(284)] - NIC offloading on eth0: RX SET TX SET. Run: ethtool -K eth0 rx off tx off
29/7/2016 -- 12:59:32 - <Warning> - [ERRCODE: SC_ERR_NIC_OFFLOADING(284)] - NIC offloading on eth0: SG: SET,  GRO: SET, LRO: unset, TSO: SET, GSO: SET. Run: ethtool -K eth0 sg off gro off lro off tso off gso off
29/7/2016 -- 12:59:32 - <Error> - [ERRCODE: SC_ERR_THREAD_INIT(49)] - thread "RX#01-" closed on initialization.
29/7/2016 -- 12:59:32 - <Error> - [ERRCODE: SC_ERR_INITIALIZATION(45)] - Engine initialization failed, aborting...

This is what we have in our config file.

pcap:
  - interface: eth0

In the previous version it just worked even when we run Suricata as a service.

We tested on both CentOS 7 and Ubuntu server 16.04 with same results.

Thanks in advance.

Actions #1

Updated by Jason Ish about 5 years ago

  • Assignee set to Jason Ish

Assigning to me - I've already started looking into the issue.

Actions #2

Updated by Jason Ish about 5 years ago

Just to follow up, I have a pull request here:

https://github.com/inliniac/suricata/pull/2183

The patch should be pretty easily to manually apply if you desire to so.

Actions #3

Updated by Jason Ish about 5 years ago

  • Status changed from New to Assigned
  • Target version set to 70
Actions #4

Updated by Victor Julien about 5 years ago

  • Description updated (diff)
Actions #5

Updated by Jason Ish about 5 years ago

  • Status changed from Assigned to Closed
  • Target version changed from 70 to 3.1.2
Actions

Also available in: Atom PDF