Yes.<br><br><div class="gmail_quote">On 22 May 2012 10:12, Victor Julien <span dir="ltr"><<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Does it work with the large ruleset as well now?<br>
<div class="im"><br>
On 05/22/2012 10:09 AM, Geert Alberghs wrote:<br>
> Hi Victor,<br>
><br>
</div><div class="im">> Works like a charm now, including the large ruleset. We had the<br>
> following in our yaml before:<br>
><br>
> - interface: bond0<br>
> bpf-filter: "not vlan"<br>
> - interface: vlan411<br>
><br>
> I suppose that the problem is bpf interpretation via the command-line?<br>
><br>
> Gtz<br>
><br>
> Geert<br>
><br>
> On 21 May 2012 17:19, Victor Julien <<a href="mailto:victor@inliniac.net">victor@inliniac.net</a><br>
</div><div><div class="h5">> <mailto:<a href="mailto:victor@inliniac.net">victor@inliniac.net</a>>> wrote:<br>
><br>
> On 05/21/2012 05:14 PM, Geert Alberghs wrote:<br>
> > Hi Victor,<br>
> ><br>
> > Thanks for your quick reply. I tried: suricata -c<br>
> > /etc/suricata/suricata.yaml -S /dev/null -i bond0 -i vlan411 "not<br>
> vlan"<br>
> ><br>
> > It produces the following error in suricata.log:<br>
> ><br>
> > 21/5/2012 -- 17:07:32 - <Error> - [ERRCODE: SC_ERR_BPF(125)] - bpf<br>
> > compilation error illegal token: ���<br>
> > 21/5/2012 -- 17:07:32 - <Error> - [ERRCODE: SC_ERR_THREAD_INIT(49)] -<br>
> > thread "RecvPcap-bond0" closed on initialization.<br>
> > 21/5/2012 -- 17:07:32 - <Error> - [ERRCODE:<br>
> SC_ERR_INITIALIZATION(45)] -<br>
> > Engine initialization failed, aborting...<br>
><br>
> You can enter the bpf filter also in the yaml file for each interface,<br>
> could you give that a try?<br>
><br>
> pcap:<br>
> - interface: bond0<br>
> bpf-filter: "not vlan"<br>
> - interface: vlan411<br>
> bpf-filter: "not vlan"<br>
><br>
> Cheers,<br>
> Victor<br>
><br>
> > gdb gives the same error messages.<br>
> ><br>
> > 21/5/2012 -- 17:12:36 - <Error> - [ERRCODE: SC_ERR_THREAD_INIT(49)] -<br>
> > thread "RecvPcap-vlan41" closed on initialization.<br>
> > 21/5/2012 -- 17:12:36 - <Error> - [ERRCODE:<br>
> SC_ERR_INITIALIZATION(45)] -<br>
> > Engine initialization failed, aborting...<br>
> > [Thread 0x7fffec34d700 (LWP 18314) exited]<br>
> > [Thread 0x7fffe9347700 (LWP 18320) exited]<br>
> > [Thread 0x7fffe9b48700 (LWP 18319) exited]<br>
> > [Thread 0x7fffea349700 (LWP 18318) exited]<br>
> > [Thread 0x7fffe8b46700 (LWP 18321) exited]<br>
> > [Thread 0x7fffeab4a700 (LWP 18317) exited]<br>
> > [Thread 0x7fffeb34b700 (LWP 18316) exited]<br>
> > [Thread 0x7fffebb4c700 (LWP 18315) exited]<br>
> > [Thread 0x7fffecb4e700 (LWP 18313) exited]<br>
> > [Thread 0x7fffed34f700 (LWP 18312) exited]<br>
> > [Thread 0x7fffedb50700 (LWP 18311) exited]<br>
> > [Thread 0x7fffee351700 (LWP 18310) exited]<br>
> > [Thread 0x7fffeed68700 (LWP 18309) exited]<br>
> > [Thread 0x7fffef569700 (LWP 18308) exited]<br>
> > [Thread 0x7fffefd6a700 (LWP 18307) exited]<br>
> > [Thread 0x7ffff48d4700 (LWP 18306) exited]<br>
> > [Thread 0x7ffff536a700 (LWP 18305) exited]<br>
> > [Thread 0x7ffff636c700 (LWP 18303) exited]<br>
> > [Thread 0x7fffe8345700 (LWP 18322) exited]<br>
> ><br>
> > Gtz<br>
> ><br>
> > Geert<br>
> ><br>
> > On 21 May 2012 16:59, Victor Julien <<a href="mailto:victor@inliniac.net">victor@inliniac.net</a><br>
> <mailto:<a href="mailto:victor@inliniac.net">victor@inliniac.net</a>><br>
</div></div><div><div class="h5">> > <mailto:<a href="mailto:victor@inliniac.net">victor@inliniac.net</a> <mailto:<a href="mailto:victor@inliniac.net">victor@inliniac.net</a>>>> wrote:<br>
> ><br>
> > On 05/21/2012 04:50 PM, Geert Alberghs wrote:<br>
> > > Hello,<br>
> > ><br>
> > > when using the following command to launch suricata:<br>
> > ><br>
> > > *exec suricata -D --pidfile /var/run/suricata.pid -c<br>
> > > /etc/suricata/suricata.yaml -i bond0 -i vlan411 "not vlan"*<br>
> > ><br>
> > > Suricata starts normally, analyses the rules, loads them<br>
> etc. But<br>
> > a few<br>
> > > moments after this the process stops without any notification in<br>
> > > suricata.log.<br>
> > ><br>
> > > When the same command is launched but without the vlan<br>
> interfaces,<br>
> > > everything works fine. Is there a multi-interfaces problem<br>
> or a vlan<br>
> > > untagging problem, I don't know.<br>
> > ><br>
> > > The reason why the vlan's are used is because of mirroring<br>
> limitations<br>
> > > in a particular switch: all incoming traffic on the mirror<br>
> port is in<br>
> > > the default vlan, all outgoing in vlan 411.<br>
> > ><br>
> > > gdb output for *suricata -c /etc/suricata/suricata.yaml -i<br>
> bond0 -i<br>
> > > vlan411 "not vlan"*:<br>
> > ><br>
> > > 21/5/2012 -- 15:54:48 - <Info> - 15 rule files processed.<br>
> 41435 rules<br>
> > > succesfully loaded, 0 rules failed<br>
> > > 21/5/2012 -- 15:56:45 - <Info> - 42631 signatures processed.<br>
> 1809 are<br>
> > > IP-only rules, 37788 are inspecting packet payload, 13120<br>
> inspect<br>
> > > application layer, 0 are decoder event only<br>
> > > 21/5/2012 -- 15:56:45 - <Info> - building signature grouping<br>
> > structure,<br>
> > > stage 1: adding signatures to signature source addresses...<br>
> complete<br>
> > > 21/5/2012 -- 15:56:50 - <Info> - building signature grouping<br>
> > structure,<br>
> > > stage 2: building source address list... complete<br>
> > > 21/5/2012 -- 15:56:55 - <Info> - building signature grouping<br>
> > structure,<br>
> > > stage 3: building destination address lists... complete<br>
> > > 21/5/2012 -- 15:57:10 - <Info> - Threshold config parsed: 5<br>
> > rule(s) found<br>
> > > 21/5/2012 -- 15:57:10 - <Info> - Core dump size set to<br>
> unlimited.<br>
> > > 21/5/2012 -- 15:57:10 - <Info> - fast output device (regular)<br>
> > > initialized: fast.log<br>
> > > 21/5/2012 -- 15:57:10 - <Info> - Unified2-alert initialized:<br>
> filename<br>
> > > unified2.alert, limit 32 MB<br>
> > > 21/5/2012 -- 15:57:10 - <Info> - http-log output device<br>
> (regular)<br>
> > > initialized: http.log<br>
> > > 21/5/2012 -- 15:57:10 - <Info> - Using 2 live device(s).<br>
> > > 21/5/2012 -- 15:57:10 - <Info> - BPF filter set from command<br>
> line<br>
> > or via<br>
> > > old 'bpf-filter' option.<br>
> > > [New Thread 0x7ffff636c700 (LWP 9636)]<br>
> > > 21/5/2012 -- 15:57:10 - <Info> - BPF filter set from command<br>
> line<br>
> > or via<br>
> > > old 'bpf-filter' option.<br>
> > > 21/5/2012 -- 15:57:10 - <Info> - using interface bond0<br>
> > > 21/5/2012 -- 15:57:10 - <Info> - Running in 'auto' checksum<br>
> mode.<br>
> > > Detection of interface state will require 1000 packets.<br>
> > > [New Thread 0x7ffff5b6b700 (LWP 9637)]<br>
> > > 21/5/2012 -- 15:57:10 - <Info> - using interface vlan411<br>
> > > 21/5/2012 -- 15:57:10 - <Info> - Running in 'auto' checksum<br>
> mode.<br>
> > > Detection of interface state will require 1000 packets.<br>
> > > [New Thread 0x7ffff536a700 (LWP 9638)]<br>
> > > [New Thread 0x7ffff4b69700 (LWP 9640)]<br>
> > ><br>
> > > Program received signal SIGSEGV, Segmentation fault.<br>
> > > [Switching to Thread 0x7ffff4b69700 (LWP 9640)]<br>
> > > 0x00007ffff69c06da in ?? () from /lib/x86_64-linux-gnu/libc.so.6<br>
> > > (gdb) btµ<br>
> > > Invalid character '�' in expression.<br>
> > > (gdb) bt<br>
> > > #0 0x00007ffff69c06da in ?? () from<br>
> /lib/x86_64-linux-gnu/libc.so.6<br>
> > > #1 0x00007ffff69c1f72 in ?? () from<br>
> /lib/x86_64-linux-gnu/libc.so.6<br>
> > > #2 0x00007ffff69c4e1e in malloc () from<br>
> > /lib/x86_64-linux-gnu/libc.so.6<br>
> > > #3 0x00000000004fd054 in PmqSetup ()<br>
> > > #4 0x00000000004402e8 in DetectEngineThreadCtxInit ()<br>
> > > #5 0x0000000000435b17 in DetectThreadInit ()<br>
> > > #6 0x000000000056d1ed in TmThreadsSlot1 ()<br>
> > > #7 0x00007ffff713fd8c in start_thread () from<br>
> > > /lib/x86_64-linux-gnu/libpthread.so.0<br>
> > > #8 0x00007ffff6a2ec2d in clone () from<br>
> > /lib/x86_64-linux-gnu/libc.so.6<br>
> > > #9 0x0000000000000000 in ?? ()<br>
> > ><br>
> > > Any idea where the problem might reside?<br>
> ><br>
> > The segv is in the per detection thread set up code. It may be<br>
> related<br>
> > to the high number of rules you run. Could you try running<br>
> without rules<br>
> > just to test?<br>
> ><br>
> > suricata -c /etc/suricata/suricata.yaml -S /dev/null -i bond0<br>
> -i vlan411<br>
> > "not vlan<br>
> ><br>
> > -S overrides the rule files from the yaml, in this case it loads<br>
> > dev/null which means it loads no rules.<br>
> ><br>
> > --<br>
> > ---------------------------------------------<br>
> > Victor Julien<br>
> > <a href="http://www.inliniac.net/" target="_blank">http://www.inliniac.net/</a><br>
> > PGP: <a href="http://www.inliniac.net/victorjulien.asc" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
> > ---------------------------------------------<br>
> ><br>
> > _______________________________________________<br>
> > Oisf-users mailing list<br>
> > <a href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a><br>
> <mailto:<a href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a>><br>
</div></div>> > <mailto:<a href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a><br>
<div class="im HOEnZb">> <mailto:<a href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a>>><br>
> > <a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
> ><br>
> ><br>
><br>
><br>
> --<br>
> ---------------------------------------------<br>
> Victor Julien<br>
> <a href="http://www.inliniac.net/" target="_blank">http://www.inliniac.net/</a><br>
> PGP: <a href="http://www.inliniac.net/victorjulien.asc" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
> ---------------------------------------------<br>
><br>
><br>
<br>
<br>
</div><div class="HOEnZb"><div class="h5">--<br>
---------------------------------------------<br>
Victor Julien<br>
<a href="http://www.inliniac.net/" target="_blank">http://www.inliniac.net/</a><br>
PGP: <a href="http://www.inliniac.net/victorjulien.asc" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
---------------------------------------------<br>
<br>
</div></div></blockquote></div><br>