<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Dec 22, 2012, at 12:51 PM, Eric Leblond <<a href="mailto:eric@regit.org">eric@regit.org</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Hello,<br><br>On Sat, 2012-12-22 at 12:27 +0200, Nikolay Denev wrote:<br><blockquote type="cite">Hi,<br><br><br>I'm experimenting running suricata in inline mode using IPFW divert on<br>FreeBSD.<br>And I had many errors on the console like these:<br><br><br> [100108] 22/12/2012 -- 08:59:32 - (source-ipfw.c:684) <Info><br> (VerdictIPFWThreadExitStats) -- IPFW Processing: - (Verdict0)<br> Pkts accepted 4890, dropped 120<br></blockquote>...<br><blockquote type="cite"> ipfw divert socket failed: Permission denied<br> [100108] 22/12/2012 -- 09:02:48 - (source-ipfw.c:684) <Info><br> (VerdictIPFWThreadExitStats) -- IPFW Processing: - (Verdict0)<br> Pkts accepted 4649, dropped 98<br> [100048] 22/12/2012 -- 09:02:48 - (tm-threads.c:2045) <Error><br> (TmThreadRestartThread) -- [ERRCODE:<br> SC_ERR_TM_THREADS_ERROR(136)] - thread restarts exceeded<br> threshold limit for thread "Verdict0"<br><br><br>Turns out, sendto() reruns EACCESS when sending packets with broadcast<br>address as destination without SO_BROADCAST flag set on the socket.<br>I've applied this patch and now there are no more messages like these<br>and suricata does not crash anymore.<br></blockquote><br>Really good catch!<br><br>Patch seems good to me. Can you do a pull request on github for Victor<br>or do you want me to do so ? (I've already pushed your patch to a<br>branch).<br><br>BR,<br>-- <br>Eric Leblond <<a href="mailto:eric@regit.org">eric@regit.org</a>><br>Blog: <a href="https://home.regit.org/">https://home.regit.org/</a><br><br></blockquote><br></div><div>Thanks, I've just opened a pull request <a href="https://github.com/inliniac/suricata/pull/249">https://github.com/inliniac/suricata/pull/249</a></div><div><br></div><div>Regards,</div><div>Nikolay</div><br></body></html>