<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style>
</head>
<body class='hmmessage'>
Hello Eric,<br><br>Thank you for your reply, I am a bit confused as to which interface suricata monitors traffic on? I have the bridge0 interface configured for (em1, em2, ... em5) 5 sub interfaces and em0 which is my uplink interface.<br><br>I though with -i em0 -d 8000 it would listen for traffic passing only through em0 and divert them to ipfw.<br><br>Can you please explain if I don't specify an interface with -i em0 which interface will suricata pick to monitor traffic? Will suricata pass all the traffic from the kernel to the ipfw divert socket with the -d option?<br><br>Many thanks.<br><br>Regards,<br>Shant K<br><br><br>> Subject: Re: [Oisf-users] FreeBSD 8.0 (suricata.c:636) <Error> (main) -- [ERRCODE: SC_ERR_MULTIPLE_RUN_MODE(124)]<br>> From: eleblond@edenwall.com<br>> To: shant@skylab.ca<br>> CC: oisf-users@openinfosecfoundation.org<br>> Date: Fri, 30 Jul 2010 09:17:12 +0200<br>> <br>> Hi,<br>> <br>> Le vendredi 30 juillet 2010 à 02:56 +0000, Shant Kassardjian a écrit :<br>> > Hello,<br>> > <br>> > <br>> > I can't seem to start suricata on FreeBSD 8.0<br>> > <br>> > <br>> > I have compiled with ./configure --enable-profiling --enable-ipfw <br>> ...<br>> > <br>> > # suricata -c /usr/local/etc/suricata/suricata.yaml -i em0 -d 8000 <br>> > [100183] 29/7/2010 -- 22:48:49 - (suricata.c:403) <Info> (main) --<br>> > This is Suricata version 1.0.1<br>> > [100183] 29/7/2010 -- 22:48:49 - (suricata.c:636) <Error> (main) --<br>> > [ERRCODE: SC_ERR_MULTIPLE_RUN_MODE(124)] - more than one run mode has<br>> > been specified<br>> > ...<br>> > <br>> > <br>> > <br>> > Any idea what went wrong? error message doesn't say much..<br>> <br>> It tell correctly the error ;)<br>> <br>> You've runned with options :<br>> - -i em0 which enable pcap on em0<br>> - -d 8000 you divert packet from rule 8000<br>> Thus you've got multiple run mode instead on one. You need to choose<br>> one.<br>> <br>> BR,<br>> -- <br>> Éric Leblond, eleblond@edenwall.com<br>> Téléphone : +33 1 40 24 65 04, Fax : +33 9 57 21 48 75<br>> EdenWall, http://www.edenwall.com<br> </body>
</html>