Support #306


iptables: Unknown error 4294967295

Added by Lambert Osas almost 13 years ago. Updated almost 13 years ago.

Affected Versions:


Hi all,

I'm new to Suricata and I was able to setup Suricata 1.1beta2 on a centos dedicated server. The installation was smooth and I could start the engine with this command: suricata -D -c /etc/suricata/suricata.yaml -q 0

However, when I attempted to configure IPtables with the command: iptables -I FORWARD -j NFQUEUE

I got the folowing error: iptables: Unknown error 4294967295

Please can someone yell me what might be wrong

Thanks in advance!

Actions #1

Updated by Lambert Osas almost 13 years ago

Additional info:

Below is the output of : suricata --build-info

[root@42826 ~]# suricata --build-info
[19440] 31/7/2011 -- 12:54:25 - (suricata.c:553) <Info> (main) -- This is Suricata version 1.1beta2
[19440] 31/7/2011 -- 12:54:25 - (suricata.c:436) <Info> (SCPrintBuildInfo) -- Features: NFQ LIBPCAP_VERSION_MAJOR=0 LIBCAP_NG LIBNET1.1
[19440] 31/7/2011 -- 12:54:25 - (suricata.c:450) <Info> (SCPrintBuildInfo) -- 32-bits, Little-endian architecture
[19440] 31/7/2011 -- 12:54:25 - (suricata.c:452) <Info> (SCPrintBuildInfo) -- GCC version 4.1.2 20080704 (Red Hat 4.1.2-50), C version 1999

Actions #2

Updated by Mike Pomraning almost 13 years ago

Lambert, I think this is two problems in one.

The first is that iptables doesn't understand the command you're giving it. (Do you have the right kernel modules loaded and supporting libraries available? Etc.)

The second is, I think, that some (old?) versions of iptables incorrectly complained about -1 when they meant to complain about errno. 4294967295 is what you get when you cast -1 to an unsigned 32-bit int. :)


Actions #3

Updated by Eric Leblond almost 13 years ago

This explicit message error of iptables is often linked with the lack of support of the NFQUEUE. Or your kernel is too old and does not have the feature, or the nfnetlink_queue module is not loaded.

Actions #4

Updated by Victor Julien almost 13 years ago

  • Status changed from New to Rejected

Anyhow, not a Suricata issue. Either the reporters distro or the netfilter project is the place for getting support.


Also available in: Atom PDF