Bug #4847
closedpcap: Unable to enter promiscuous mode on virtio-net device
Description
When attempting to start Suricata in a forked version of OPNsense:
[100887] <Error> -- [ERRCODE: SC_ERR_PCAP_ACTIVATE_HANDLE(27)] - could not activate the pcap handler, error BIOCPROMISC: Operation not supported
In this case, we're running Suricata git HEAD (commit 6cb6225b28c5d8e616a420b7d05b129ba2845dc0). Manually setting promisc mode via ifconfig works as does tcpdump. I've uploaded a screenshot that shows manually entering promisc mode working along with tcpdump: https://imgur.com/a/EhiOHzZ
We're running HardenedBSD 13-STABLE/amd64 (commit 49b23a3342646945ce8dc168d825aeb343ce6e2e).
Updated by Shawn Webb over 2 years ago
It appears I completely missed reading the error that tcpdump threw. I apologize for that.
Updated by Victor Julien over 2 years ago
- Subject changed from Unable to enter promiscuous mode on virtio-net device to pcap: Unable to enter promiscuous mode on virtio-net device
Do you believe there is a bug still? If not we can close it.
Updated by Shawn Webb over 2 years ago
Victor Julien wrote in #note-2:
Do you believe there is a bug still? If not we can close it.
Not a bug. At least, not in Suricata. This can be closed. Sorry for the noise.