Project

General

Profile

Feature #1940

Debian Jessie - better message when trying to run 2 suricata with afpacket

Added by Peter Manev almost 2 years ago. Updated about 1 month ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:

Description

Using - 3.2dev (rev 5dc9c1b) and Debian Jessie - when there is already a running Suricata and a second one is started -

/usr/bin/suricata -c /etc/suricata/suricata.yaml -S test.rules  --af-packet

It results in a misleading message:

[16487] 28/10/2016 -- 16:40:08 - (runmode-af-packet.c:404) <Notice> (ParseAFPConfig) -- fanout not supported on this system, falling back to 1 capture thread
[16487] 28/10/2016 -- 16:40:08 - (tm-threads.c:2098) <Notice> (TmThreadWaitOnThreadInit) -- all 1 packet processing threads, 4 management threads initialized, engine started.

History

#1 Updated by Eric Leblond almost 2 years ago

Fix should be implemented by https://github.com/regit/suricata/commit/ed22ba202beec77cb5416702caa0cb21d77767d7. Can you feedback on this ?

#2 Updated by Victor Julien almost 2 years ago

  • Target version changed from 3.2rc1 to TBD

#3 Updated by Peter Manev almost 2 years ago

With the provided fix there is no misleading message but no hit at what could be the reason either:

/usr/bin/suricata -c /etc/suricata/suricata.yaml --af-packet  -v
[12182] 29/11/2016 -- 10:34:16 - (suricata.c:1005) <Notice> (SCPrintVersion) -- This is Suricata version 3.2dev (rev ed22ba2)
[12182] 29/11/2016 -- 10:34:16 - (util-cpu.c:170) <Info> (UtilCpuPrintSummary) -- CPUs/cores online: 8
[12182] 29/11/2016 -- 10:34:16 - (app-layer-dnp3.c:1603) <Warning> (RegisterDNP3Parsers) -- [ERRCODE: SC_ERR_DNP3_CONFIG(290)] - No DNP3 configuration found, enabling DNP3 detection on port 20000
[12182] 29/11/2016 -- 10:34:16 - (app-layer-dnp3.c:1618) <Info> (RegisterDNP3Parsers) -- Registering DNP3/tcp parsers.
[12182] 29/11/2016 -- 10:34:16 - (util-ioctl.c:105) <Info> (GetIfaceMTU) -- Found an MTU of 1500 for 'wlan0'
[12182] 29/11/2016 -- 10:34:16 - (util-conf.c:109) <Info> (ConfUnixSocketIsEnable) -- Running in live mode, activating unix socket
[12182] 29/11/2016 -- 10:34:19 - (detect.c:507) <Info> (SigLoadSignatures) -- 39 rule files processed. 12689 rules successfully loaded, 0 rules failed
[12182] 29/11/2016 -- 10:34:19 - (detect.c:3502) <Info> (SigAddressPrepareStage1) -- 12697 signatures processed. 1180 are IP-only rules, 5135 are inspecting packet payload, 8004 inspect application layer, 0 are decoder event only
[12182] 29/11/2016 -- 10:34:20 - (util-threshold-config.c:1188) <Info> (SCThresholdConfParseFile) -- Threshold config parsed: 0 rule(s) found
[12182] 29/11/2016 -- 10:34:20 - (util-logopenfile.c:298) <Info> (SCConfLogOpenGeneric) -- fast output device (regular) initialized: fast.log
[12182] 29/11/2016 -- 10:34:20 - (util-logopenfile.c:298) <Info> (SCConfLogOpenGeneric) -- eve-log output device (regular) initialized: eve.json
[12182] 29/11/2016 -- 10:34:20 - (util-logopenfile.c:298) <Info> (SCConfLogOpenGeneric) -- stats output device (regular) initialized: stats.log
[12182] 29/11/2016 -- 10:34:20 - (util-runmodes.c:285) <Info> (RunModeSetLiveCaptureWorkersForDevice) -- Going to use 1 thread(s)
[12182] 29/11/2016 -- 10:34:20 - (util-conf.c:109) <Info> (ConfUnixSocketIsEnable) -- Running in live mode, activating unix socket
[12182] 29/11/2016 -- 10:34:20 - (tm-threads.c:2098) <Notice> (TmThreadWaitOnThreadInit) -- all 1 packet processing threads, 4 management threads initialized, engine started.
[12183] 29/11/2016 -- 10:34:20 - (source-af-packet.c:476) <Info> (AFPPeersListReachedInc) -- All AFP capture threads are running.

It is definitely better than before in my view - but it seems the msg - https://github.com/regit/suricata/commit/ed22ba202beec77cb5416702caa0cb21d77767d7#diff-e77389f2d8111b800388ad83c1ca6b73R404 does not kick in ?

#4 Updated by Eric Leblond about 1 month ago

  • Subject changed from Debian Jessie - better mesage when trying to run 2 suricata with afpacket to Debian Jessie - better message when trying to run 2 suricata with afpacket

Also available in: Atom PDF