Project

General

Profile

Actions

Support #2040

closed

ERRCODE: SC_ERR_AFP_CREATE(190) fail to start

Added by Thomas Chan about 7 years ago. Updated about 7 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Affected Versions:
Label:

Description

I got these 2 error messages from suricata.log, I believe service is not running, I don't see stat.log are getting updated.

[31550] 17/2/2017 -- 13:45:58 - (source-af-packet.c:2019) <Error> (AFPSetBPFFilter) -- [ERRCODE: SC_ERR_AFP_CREATE(190)] - Filter compilation failed.
[31550] 17/2/2017 -- 13:45:58 - (source-af-packet.c:1975) <Error> (AFPCreateSocket) -- [ERRCODE: SC_ERR_AFP_CREATE(190)] - Set AF_PACKET bpf filter "âD" failed.

====
here is my build info
./suricata --build-info
This is Suricata version 3.1dev
Features: NFQ PCAP_SET_BUFF LIBPCAP_VERSION_MAJOR=1 AF_PACKET HAVE_PACKET_FANOUT HAVE_HTP_URI_NORMALIZE_HOOK HAVE_LUA HAVE_LIBJANSSON TLS
SIMD support: SSE_4_2 SSE_4_1 SSE_3
Atomic intrisics: 1 2 4 8 16 byte(s)
64-bits, Little-endian architecture
GCC version 4.4.7 20120313 (Red Hat 4.4.7-16), C version 199901
compiled with _FORTIFY_SOURCE=0
L1 cache line size (CLS)=64
thread local storage method: __thread
compiled with LibHTP v0.5.23, linked against LibHTP v0.5.23

Suricata Configuration:
AF_PACKET support: yes
PF_RING support: no
NFQueue support: yes
NFLOG support: no
IPFW support: no
Netmap support: no
DAG enabled: no
Napatech enabled: no

Unix socket enabled:                     yes
Detection enabled: yes
libnss support:                          no
libnspr support: no
libjansson support: yes
hiredis support: no
Prelude support: no
PCRE jit: no
LUA support: yes
libluajit: no
libgeoip: no
Non-bundled htp: yes
Old barnyard2 support: no
CUDA enabled: no
Hyperscan support: no
Libnet support: no
Suricatasc install:                      yes
Profiling enabled:                       no
Profiling locks enabled: no

Development settings:
Coccinelle / spatch: no
Unit tests enabled: no
Debug output enabled: no
Debug validation enabled: no

Generic build parameters:
Installation prefix: /app/suricata
Configuration directory: /app/suricata/etc/suricata/
Log directory: /app/suricata/log/log/suricata/

--prefix                                 /app/suricata
--sysconfdir /app/suricata/etc
--localstatedir /app/suricata/log
Host:                                    x86_64-unknown-linux-gnu
Compiler: gcc (exec name) / gcc (real)
GCC Protect enabled: no
GCC march native enabled: yes
GCC Profile enabled: no
Position Independent Executable enabled: no
CFLAGS -g -O2 -march=native
PCAP_CFLAGS
SECCFLAGS
Actions #1

Updated by Victor Julien about 7 years ago

Can you share your commandline? This error indicates there are trailing characters on it.

Actions #2

Updated by Thomas Chan about 7 years ago

/app/suricata/bin/suricata -c /app/suricata/etc/suricata/suricata.yaml -i eth1 --init-errors-fatal –D

Actions #3

Updated by Eric Leblond about 7 years ago

  • Status changed from New to Closed

Thomas Chan wrote:

/app/suricata/bin/suricata -c /app/suricata/etc/suricata/suricata.yaml -i eth1 --init-errors-fatal –D

This is not a -
You are not using a - so it is not seen as an option and parsed as a BPF.
Actions #4

Updated by Eric Leblond about 7 years ago

Formatting did not work. The problem is on -D.

Actions #5

Updated by Thomas Chan about 7 years ago

Thanks guys!!!
my fault!

Actions

Also available in: Atom PDF