Project

General

Profile

Actions

Bug #4847

closed

pcap: Unable to enter promiscuous mode on virtio-net device

Added by Shawn Webb over 2 years ago. Updated 9 months ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
-
Affected Versions:
Effort:
Difficulty:
Label:

Description

When attempting to start Suricata in a forked version of OPNsense:

[100887] <Error> -- [ERRCODE: SC_ERR_PCAP_ACTIVATE_HANDLE(27)] - could not activate the pcap handler, error BIOCPROMISC: Operation not supported

In this case, we're running Suricata git HEAD (commit 6cb6225b28c5d8e616a420b7d05b129ba2845dc0). Manually setting promisc mode via ifconfig works as does tcpdump. I've uploaded a screenshot that shows manually entering promisc mode working along with tcpdump: https://imgur.com/a/EhiOHzZ

We're running HardenedBSD 13-STABLE/amd64 (commit 49b23a3342646945ce8dc168d825aeb343ce6e2e).

Actions #1

Updated by Shawn Webb over 2 years ago

It appears I completely missed reading the error that tcpdump threw. I apologize for that.

Actions #2

Updated by Victor Julien over 2 years ago

  • Subject changed from Unable to enter promiscuous mode on virtio-net device to pcap: Unable to enter promiscuous mode on virtio-net device

Do you believe there is a bug still? If not we can close it.

Actions #3

Updated by Shawn Webb over 2 years ago

Victor Julien wrote in #note-2:

Do you believe there is a bug still? If not we can close it.

Not a bug. At least, not in Suricata. This can be closed. Sorry for the noise.

Actions #4

Updated by Philippe Antoine 9 months ago

  • Status changed from New to Closed
Actions

Also available in: Atom PDF