<div dir="ltr">Hi Eric,<div><br></div><div>I addded a printf into source-ipfw.c line 557.</div><div><br></div><div><div> PrintInet(AF_INET, (const void *) GET_IPV4_SRC_ADDR_PTR(p), srcip, srcip_len);</div>
<div> PrintInet(AF_INET, (const void *) GET_IPV4_DST_ADDR_PTR(p), dstip, dstip_len);</div><div> printf( "fd: %d, data_p: %p, length: %u ", nq->fd, GET_PKT_DATA(p),GET_PKT_LEN(p) );</div>
<div> printf( "src ip : %s ", srcip );</div><div> printf( "dst ip : %s\n", dstip );</div></div><div><br></div><div>But i saw that, these packets are routable packets. I don't think that problem is about non routable packages.</div>
<div><br></div><div><div>fd: 7, data_p: 0x8045ce578, length: 95 src ip : 10.2.2.10 dst ip : 92.83.122.63</div><div>6/3/2014 -- 10:41:24 - <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write to ipfw divert socket failed: Permission denied</div>
<div>6/3/2014 -- 10:41:24 - <Info> - IPFW Processing: - (Verdict0) Pkts accepted 9118, dropped 3</div><div>6/3/2014 -- 10:41:24 - <Info> - thread "Verdict0" restarted</div><div>fd: 7, data_p: 0x8045eeb78, length: 58 src ip : 10.2.2.10 dst ip : 116.193.135.211</div>
<div>6/3/2014 -- 10:41:24 - <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write to ipfw divert socket failed: Permission denied</div><div>6/3/2014 -- 10:41:24 - <Info> - IPFW Processing: - (Verdict0) Pkts accepted 35, dropped 0</div>
<div>6/3/2014 -- 10:41:24 - <Info> - thread "Verdict0" restarted</div><div>fd: 7, data_p: 0x8044cc378, length: 58 src ip : 10.2.2.10 dst ip : 220.255.54.21</div><div>6/3/2014 -- 10:41:43 - <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write to ipfw divert socket failed: Permission denied</div>
<div>6/3/2014 -- 10:41:43 - <Info> - IPFW Processing: - (Verdict0) Pkts accepted 8877, dropped 0</div><div>6/3/2014 -- 10:41:43 - <Info> - thread "Verdict0" restarted</div><div>fd: 7, data_p: 0x8044cd178, length: 58 src ip : 10.2.2.10 dst ip : 220.255.1.178</div>
<div>6/3/2014 -- 10:41:43 - <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write to ipfw divert socket failed: Permission denied</div><div>6/3/2014 -- 10:41:43 - <Info> - IPFW Processing: - (Verdict0) Pkts accepted 1, dropped 0</div>
<div>6/3/2014 -- 10:41:43 - <Info> - thread "Verdict0" restarted</div><div>fd: 7, data_p: 0x8044cdf78, length: 58 src ip : 10.2.2.10 dst ip : 223.29.197.237</div><div>6/3/2014 -- 10:41:43 - <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write to ipfw divert socket failed: Permission denied</div>
<div>6/3/2014 -- 10:41:43 - <Info> - IPFW Processing: - (Verdict0) Pkts accepted 1, dropped 0</div><div>6/3/2014 -- 10:41:43 - <Info> - thread "Verdict0" restarted</div><div>fd: 7, data_p: 0x8044ced78, length: 58 src ip : 10.2.2.10 dst ip : 109.161.142.206</div>
<div>6/3/2014 -- 10:41:43 - <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write to ipfw divert socket failed: Permission denied</div><div>6/3/2014 -- 10:41:43 - <Info> - IPFW Processing: - (Verdict0) Pkts accepted 1, dropped 0</div>
<div>6/3/2014 -- 10:41:43 - <Info> - thread "Verdict0" restarted</div><div>fd: 7, data_p: 0x8044cfb78, length: 58 src ip : 10.2.2.10 dst ip : 110.175.191.10</div><div>6/3/2014 -- 10:41:43 - <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write to ipfw divert socket failed: Permission denied</div>
<div>6/3/2014 -- 10:41:43 - <Info> - IPFW Processing: - (Verdict0) Pkts accepted 1, dropped 0</div><div>6/3/2014 -- 10:41:43 - <Info> - thread "Verdict0" restarted</div><div>fd: 7, data_p: 0x8044d0978, length: 58 src ip : 10.2.2.10 dst ip : 110.74.201.253</div>
<div>6/3/2014 -- 10:41:43 - <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write to ipfw divert socket failed: Permission denied</div><div>6/3/2014 -- 10:41:43 - <Info> - IPFW Processing: - (Verdict0) Pkts accepted 1, dropped 0</div>
<div>6/3/2014 -- 10:41:43 - <Info> - thread "Verdict0" restarted</div><div>fd: 7, data_p: 0x8044d1778, length: 58 src ip : 10.2.2.10 dst ip : 110.175.99.68</div><div>6/3/2014 -- 10:41:43 - <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write to ipfw divert socket failed: Permission denied</div>
<div>6/3/2014 -- 10:41:43 - <Info> - IPFW Processing: - (Verdict0) Pkts accepted 1, dropped 0</div><div>6/3/2014 -- 10:41:43 - <Info> - thread "Verdict0" restarted</div><div>fd: 7, data_p: 0x8044c2978, length: 60 src ip : 10.2.2.10 dst ip : 224.0.0.252</div>
<div>6/3/2014 -- 10:41:53 - <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write to ipfw divert socket failed: Permission denied</div><div>6/3/2014 -- 10:41:53 - <Info> - IPFW Processing: - (Verdict0) Pkts accepted 6114, dropped 0</div>
<div>6/3/2014 -- 10:41:53 - <Info> - thread "Verdict0" restarted</div></div><div><br></div><div><br></div><div><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Mar 6, 2014 at 9:17 AM, Özkan KIRIK <span dir="ltr"><<a href="mailto:ozkan.kirik@gmail.com" target="_blank">ozkan.kirik@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><span style="font-family:arial,sans-serif;font-size:13px"><div>ipfw -ad list</div><div><br></div><div>
00004 0 0 deny ip from any to any MAC e8:03:9a:0f:74:7b any</div><div>00005 63668675 49628511386 allow ip from any to any layer2</div>
</span></div><span style="font-family:arial,sans-serif;font-size:13px">00100</span><span style="font-family:arial,sans-serif"> </span><span style="font-family:arial,sans-serif;font-size:13px"> 25849</span><span style="font-family:arial,sans-serif"> </span><span style="font-family:arial,sans-serif;font-size:13px">4724396 divert 8000 all from any to 10.2.2.10 not layer2</span><br style="font-family:arial,sans-serif;font-size:13px">
<span style="font-family:arial,sans-serif;font-size:13px">00200</span><span style="font-family:arial,sans-serif"> </span><span style="font-family:arial,sans-serif;font-size:13px"> 26579</span><span style="font-family:arial,sans-serif"> </span><span style="font-family:arial,sans-serif;font-size:13px">5122809 divert 8000 all from 10.2.2.10 to any not layer2</span><div>
<font face="arial, sans-serif"><div>00300 365312 25436015 skipto 600 udp from any to any dst-port 53,1812</div><div>00400 334817 71431398 skipto 600 udp from any 53,1812 to any</div><div>00500 77815 5612395 deny udp from any to any</div>
<div><div>00600 4928083 1457516245 nat tablearg ip from table(10) to any via igb1 // VLAN NAT</div><div>00600 13655296 16815414254 nat tablearg ip from any to table(11) via igb1 // VLAN NAT</div></div></font><div>
<span style="font-family:arial,sans-serif;font-size:13px">##Dynamic rules:</span></div></div><div><span style="font-family:arial,sans-serif;font-size:13px"><br></span></div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra">
<br><br><div class="gmail_quote">
On Thu, Mar 6, 2014 at 1:02 AM, Eric Leblond <span dir="ltr"><<a href="mailto:eric@regit.org" target="_blank">eric@regit.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi,<br>
<div><br>
On Thu, 2014-03-06 at 00:55 +0200, Özkan KIRIK wrote:<br>
> I tried to compile both clang and gcc. Result was same.<br>
><br>
> This error appears sometimes. Not for all packets.<br>
><br>
> There is only one rule : pass ip any any -> any any<br>
<br>
</div>There is an old memory coming back to me. Not sure but I think this is<br>
linked with non routable packet reaching the filter (packet going to the<br>
box for example). And there is a failure at reinject because the packet<br>
can't be send.<br>
<br>
BR,<br>
<div><div><br>
><br>
><br>
> 6 Mar 2014 00:49 tarihinde "Özkan KIRIK" <<a href="mailto:ozkan.kirik@gmail.com" target="_blank">ozkan.kirik@gmail.com</a>><br>
> yazdı:<br>
> Hi,<br>
><br>
> I was running suricata with these arguments;<br>
><br>
> suricata -vv -d 8000<br>
><br>
> ipfw add divert 8000 all from any to 10.2.2.10<br>
> ipfw add divert 8000 all from 10.2.2.10 to any<br>
><br>
> 6 Mar 2014 00:45 tarihinde "Shirkdog" <<a href="mailto:shirkdog@gmail.com" target="_blank">shirkdog@gmail.com</a>><br>
> yazdı:<br>
> Do you have ipfw setup with the divert socket set to a<br>
> port?<br>
><br>
> On Mar 5, 2014 5:17 PM, "Özkan KIRIK"<br>
> <<a href="mailto:ozkan.kirik@gmail.com" target="_blank">ozkan.kirik@gmail.com</a>> wrote:<br>
> Hi,<br>
><br>
><br>
> I'm using FreeBSD 10 ipfw and ipdivert<br>
> enabled.<br>
> I tried suricata v.1.4.6, v1.4.7 and also<br>
> 2.0rc1.<br>
><br>
><br>
> All versions throws this error sometimes<br>
> "<Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)]<br>
> - Write to ipfw divert socket failed:<br>
> Permission denied"<br>
> After a while, thread restart threshold<br>
> exceeded and suricata completely shutdown.<br>
><br>
><br>
> I was diverted only 1 host to suricata. But<br>
> still gives this error.<br>
><br>
><br>
> It's strange, I inspected the source-ipfw.c<br>
> file. The problem about injecting packet back<br>
> to divert socket.<br>
><br>
><br>
> errno = 13 - EACCESS.<br>
><br>
><br>
> I saw that SO_BROADCAST option was set to<br>
> socket.<br>
><br>
><br>
> How can i debug this situation, or any<br>
> solutions?<br>
><br>
><br>
> Best regards<br>
><br>
> _______________________________________________<br>
> Suricata IDS Users mailing list:<br>
> <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundation.org</a><br>
> Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support:<br>
> <a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br>
> List:<br>
> <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
> OISF: <a href="http://www.openinfosecfoundation.org/" target="_blank">http://www.openinfosecfoundation.org/</a><br>
</div></div>> _______________________________________________<br>
> Suricata IDS Devel mailing list: <a href="mailto:oisf-devel@openinfosecfoundation.org" target="_blank">oisf-devel@openinfosecfoundation.org</a><br>
> Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Participate: <a href="http://suricata-ids.org/participate/" target="_blank">http://suricata-ids.org/participate/</a><br>
> List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel</a><br>
> Redmine: <a href="https://redmine.openinfosecfoundation.org/" target="_blank">https://redmine.openinfosecfoundation.org/</a><br>
<span><font color="#888888"><br>
--<br>
Eric Leblond <<a href="mailto:eric@regit.org" target="_blank">eric@regit.org</a>><br>
<br>
</font></span></blockquote></div><br></div>
</div></div></blockquote></div><br></div>