Bug #943: pfring: see if we can report that the module is not loaded - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #943

closed

pfring: see if we can report that the module is not loaded

Added by Victor Julien over 10 years ago. Updated over 10 years ago.

Status:

Closed

Priority:

Low

Assignee:

Eric Leblond

Target version:

2.0beta2

Affected Versions:

Effort:

Difficulty:

Label:

Description

If the pfring kernel module is not loaded, currently we just give

[7705] 9/9/2013 -- 10:58:22 - (source-pfring.c:409) <Error> (ReceivePfringThreadInit) -- [ERRCODE: SC_ERR_PF_RING_OPEN(34)] - opening eth1 failed: pfring_open error

But maybe/hopefully the lib will be able to tell us the kernel part is not loaded.

Actions

Copy link

Updated by Victor Julien over 10 years ago

Priority changed from Normal to Low
Target version changed from 2.0rc2 to 2.0beta2

Actions

Copy link

Updated by Eric Leblond over 10 years ago

I've checked PF_RING documentation and pf_ring_open code. Both studies lead to the conclusion that there is no error return. So it is impossible to get the reason of the error from the library.

I think we should close this ticket for now.

Actions

Copy link

Updated by Victor Julien over 10 years ago

Maybe we can just add a more verbose error message. Something like:

[7705] 9/9/2013 -- 10:58:22 - (source-pfring.c:409) <Error> (ReceivePfringThreadInit) -- [ERRCODE: SC_ERR_PF_RING_OPEN(34)] - opening eth1 failed: pfring_open error. Check if eth1 exists and pf_ring module is loaded.

Actions

Copy link