<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body><div><div style="font-family: Calibri,sans-serif; font-size: 11pt;">Jason is right. You should only use the -q to define the queue to listen on for packets. You can have multiple -q, one for each queue you have defined with iptables/nftables.</div></div><div dir="ltr"><hr><span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">De: </span><span style="font-family: Calibri,sans-serif; font-size: 11pt;"><a href="mailto:lists@unx.ca">Jason Ish</a></span><br><span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">Enviado: </span><span style="font-family: Calibri,sans-serif; font-size: 11pt;">08/08/2015 22:43</span><br><span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">Para: </span><span style="font-family: Calibri,sans-serif; font-size: 11pt;"><a href="mailto:jimoe@sohnen-moe.com">James Moe</a></span><br><span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">Cc: </span><span style="font-family: Calibri,sans-serif; font-size: 11pt;"><a href="mailto:oisf-users@lists.openinfosecfoundation.org">oisf-users@lists.openinfosecfoundation.org</a></span><br><span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">Assunto: </span><span style="font-family: Calibri,sans-serif; font-size: 11pt;">Re: [Oisf-users] Suricata does not start in NFQ mode</span><br><br></div>Hi James,<br><br>I have not used nfq mode myself in a long time, but read further inline...<br><br>On Sat, Aug 8, 2015 at 3:10 PM, James Moe <jimoe@sohnen-moe.com> wrote:<br>> linux 3.16.7-21-desktop x86_64<br>><br>> I built suricata with --enable-nfqueue. When I add "-q 0" to the<br>> command line, the following error is emitted:<br>><br>> /usr/local/bin/suricata -v --pidfile /d500g/var/run/suricata.pid -c<br>> /usr/local/etc/suricata/suricata.yaml -q 0 -i eth0<br>> 8/8/2015 -- 13:38:25 - <Error> - [ERRCODE:<br>> SC_ERR_MULTIPLE_RUN_MODE(126)] - more than one run mode has been specified<br>> Suricata 2.0.8<br><br>I believe with NFQ you do not specify an interface with -i. -i tells<br>Suricata to use pcap mode on that interface. With NFQ, Suricata<br>doesn't need to know which interface to listen on, that would be setup<br>with the iptables tools.<br><br>Hope that helps,<br>Jason<br>_______________________________________________<br>Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br>Suricata User Conference November 4 & 5 in Barcelona: http://oisfevents.net<br></body></html>