<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style>
</head>
<body class='hmmessage'>
Thanks guys for the detailed explanation! I managed to get suricata working in IPS mode on HIGH memory settings with my core 2 duo it feels 2x faster than snort! (only 10 rules loaded though)<BR><br><BR>Anyways, I know have another problem the spite suricata is functioning properly, I get the following error on each web site I browse:<BR><br><BR>[100154] 30/7/2010 -- 19:36:28 - (app-layer-parser.c:931) <Error> (AppLayerParse) -- [ERRCODE: SC_ERR_ALPARSER(59)] - Error occured in parsing "http" app layer protocol, using network protocol 6, source IP address 172.25.1.10, destination IP address 24.200.239.18, src port 49343 and dst port 80<br><br><br>[100154] 30/7/2010 -- 19:44:03 - (app-layer-parser.c:931) <Error> (AppLayerParse) -- [ERRCODE: SC_ERR_ALPARSER(59)] - Error occured in parsing "http" app layer protocol, using network protocol 6, source IP address 172.25.1.10, destination IP address 64.191.203.30, src port 49580 and dst port 80<br><br><BR>Is this a configuration problem? There might be a small performance hit because of this problem.<BR><br><BR>Many thanks for the help.<BR><br><BR><br><BR><br>> To: rmkml@free.fr; oisf-users-bounces@openinfosecfoundation.org; shant@skylab.ca<br>> From: oisf@rogness.net<br>> Date: Fri, 30 Jul 2010 17:46:40 +0000<br>> CC: oisf-users@openinfosecfoundation.org<br>> Subject: Re: [Oisf-users] FreeBSD 8.0 (suricata.c:636) <Error> (main) --[ERRCODE: SC_ERR_MULTIPLE_RUN_MODE(124)]<br>> <br>> You must specify which packets to send to suricata via an ipfw rule. For example:<br>> <br>> ipfw divert 8000 ip from any to any via em0<br>> <br>> This example ipfw rule instructs the kernel to send packets, of type IP, with any source/destination address, which either come in or out interface em0, to a divert socket 8000.<br>> <br>> Suricata, configured with -d 8000, picks the packets off by listening to this divert socket 8000.<br>> <br>> The 8000 specified in the suricata argument to -d MUST match the same value which is added in the 'ipfw divert 8000 ...' command, or suricata will not see packets from IPFW.<br>> <br>> The -i em0 flag is not need for suricata running with IPFW divert sockets. It would only be need if you were running in IDS mode via pcap or equivalent.<br>> <br>> Hope this helps.<br>> <br>> Nick<br>> <br>> Sent from my BlackBerry Smartphone provided by Alltel<br>> <br>> -----Original Message-----<br>> From: rmkml <rmkml@free.fr><br>> Sender: oisf-users-bounces@openinfosecfoundation.org<br>> Date: Fri, 30 Jul 2010 18:50:04 <br>> To: Shant Kassardjian<shant@skylab.ca><br>> Cc: <oisf-users@openinfosecfoundation.org><br>> Subject: Re: [Oisf-users] FreeBSD 8.0 (suricata.c:636) <Error> (main) --<br>> [ERRCODE: SC_ERR_MULTIPLE_RUN_MODE(124)]<br>> <br>> Hi Shant,<br>> maybe can help you ?:<br>> http://www.codealias.info/technotes/freebsd_divert_sockets<br>> ..."A divert socket is a socket that can be used to alter packets before being processed by the networking stack."...<br>> Regards<br>> Rmkml<br>> <br>> <br>> On Fri, 30 Jul 2010, Shant Kassardjian wrote:<br>> <br>> > Hello Eric,<br>> > <br>> > Thank you for your reply, I am a bit confused as to which interface suricata monitors traffic on? I have the bridge0 interface configured for (em1, em2, ... em5)<br>> > 5 sub interfaces and em0 which is my uplink interface.<br>> > <br>> > I though with -i em0 -d 8000 it would listen for traffic passing only through em0 and divert them to ipfw.<br>> > <br>> > Can you please explain if I don't specify an interface with -i em0 which interface will suricata pick to monitor traffic? Will suricata pass all the traffic from<br>> > the kernel to the ipfw divert socket with the -d option?<br>> > <br>> > Many thanks.<br>> > <br>> > Regards,<br>> > Shant K<br>> > <br>> > <br>> > > Subject: Re: [Oisf-users] FreeBSD 8.0 (suricata.c:636) <Error> (main) -- [ERRCODE: SC_ERR_MULTIPLE_RUN_MODE(124)]<br>> > > From: eleblond@edenwall.com<br>> > > To: shant@skylab.ca<br>> > > CC: oisf-users@openinfosecfoundation.org<br>> > > Date: Fri, 30 Jul 2010 09:17:12 +0200<br>> > ><br>> > > Hi,<br>> > ><br>> > > Le vendredi 30 juillet 2010 à 02:56 +0000, Shant Kassardjian a écrit :<br>> > > > Hello,<br>> > > ><br>> > > ><br>> > > > I can't seem to start suricata on FreeBSD 8.0<br>> > > ><br>> > > ><br>> > > > I have compiled with ./configure --enable-profiling --enable-ipfw<br>> > > ...<br>> > > ><br>> > > > # suricata -c /usr/local/etc/suricata/suricata.yaml -i em0 -d 8000<br>> > > > [100183] 29/7/2010 -- 22:48:49 - (suricata.c:403) <Info> (main) --<br>> > > > This is Suricata version 1.0.1<br>> > > > [100183] 29/7/2010 -- 22:48:49 - (suricata.c:636) <Error> (main) --<br>> > > > [ERRCODE: SC_ERR_MULTIPLE_RUN_MODE(124)] - more than one run mode has<br>> > > > been specified<br>> > > > ...<br>> > > ><br>> > > ><br>> > > ><br>> > > > Any idea what went wrong? error message doesn't say much..<br>> > ><br>> > > It tell correctly the error ;)<br>> > ><br>> > > You've runned with options :<br>> > > - -i em0 which enable pcap on em0<br>> > > - -d 8000 you divert packet from rule 8000<br>> > > Thus you've got multiple run mode instead on one. You need to choose<br>> > > one.<br>> > ><br>> > > BR,<br>> > > --<br>> > > Éric Leblond, eleblond@edenwall.com<br>> > > Téléphone : +33 1 40 24 65 04, Fax : +33 9 57 21 48 75<br>> > > EdenWall, http://www.edenwall.com<br>> > <br>> ><br>> _______________________________________________<br>> Oisf-users mailing list<br>> Oisf-users@openinfosecfoundation.org<br>> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br> </body>
</html>