Project

General

Profile

Actions

Feature #3618

closed

Af-packet warning during startup

Added by Anonymous about 4 years ago. Updated 12 months ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
-
Effort:
Difficulty:
Label:

Description

During startup, the command suricata -c /etc/suricata/suricata.yaml --af-packet can be observed:
[15819] 7/4/2020 - 08.17.39 - (source-af-packet.c: 1426) <Warning> (AFPsynchronizeStart) - [ERRCODE: SC_ERR_AFP_READ (191)] poll failed with retval -1
How critical is this? Does this require a decision on my part?
How critical are the other errors in the screenshot?

Kernel 4.19.114 (own assembly).
OS: Ubuntu 18.04
Suricata: 4.1.7 (compiled from the last commit on 04/07/20)

Part of the config:

  1. Linux high speed capture support
    af-packet:
    - interface: ens1f0
    threads: 24
    defrag: yes
    cluster-type: cluster_ebpf
    ebpf-lb-file: /etc/suricata/ebpf/lb.bpf
    cluster-id: 98
    copy-mode: ips
    copy-iface: ens1f1
    buffer-size: 64535
    use-mmap: yes
    ring-size: 100000
    - interface: ens1f1
    threads: 24
    cluster-id: 97
    defrag: yes
    cluster-type: cluster_ebpf
    ebpf-lb-file: /etc/suricata/ebpf/lb.bpf
    copy-mode: ips
    copy-iface: ens1f0
    buffer-size: 64535
    ring-size: 100000
    use-mmap: yes

Files

1.png (74.4 KB) 1.png Anonymous, 04/07/2020 02:15 PM
Actions

Also available in: Atom PDF