<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>I've tried newer version of PFRING. 6.2 and 6.3 No luck. Here is an interesting note in the 6.2 release notes:<div><span style="font-family: 'Open Sans', 'Helvetica Neue', Helvetica, sans-serif; font-size: 14px; line-height: 21px; background-color: rgb(255, 255, 255);">PF_RING-aware Libpcap</span><ul style="margin-right: 0px; margin-left: 30px; padding-right: 0px; padding-left: 0px; border: 0px; outline: 0px; font-size: 14px; vertical-align: baseline; font-family: 'Open Sans', 'Helvetica Neue', Helvetica, sans-serif; line-height: 21px; background: rgb(255, 255, 255);"><li style="margin: 0px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background: transparent;">Fixed pcap_brekloop (tcpdump now handles sigterm correctly when there is no traffic)</li></ul><div><br></div><div>Is this what you were talking about?</div><div><br></div><div>So this sensor does get some broadcast traffic. My other sensors that have similar amount of traffic on monitored interfaces dont get stuck.</div><div><br></div><div>On this one, I get errors when trying to stop it right after starting it. Suricata reports:</div><div><div><Error> - [ERRCODE: SC_ERR_FATAL(171)] - Engine unable to disable detect thread - "RxPFReth22". Killing engine</div></div><div><br></div><div><br></div><div>I've enabled debugging in PF_RING and nothing shows until that message appears above.</div><div><br></div><div>When I try to reload rules, it starts the rebuild of grouping structure but never gives "rules reload complete" message. </div><div><br></div><div>I understand your suggestion to switch to another capture method but it seems that this should work with small amount of packets on monitored interface as it does on other sensors.</div><div><br></div><div>BTW, I've tried Suricata-3.0 with no luck.</div><div><br></div><div>Thank you for your help.</div><br><div>> Subject: Re: [Oisf-users] suricata freezes if no or little traffic is present on monitored interface<br>> From: eric@regit.org<br>> To: coolyasha@hotmail.com; andi@geekosphere.org; oisf-users@lists.openinfosecfoundation.org<br>> Date: Mon, 14 Dec 2015 17:26:05 +0100<br>> <br>> Hi,<br>> <br>> On Mon, 2015-12-14 at 16:17 +0000, Yasha Zislin wrote:<br>> > I am going to give a shot to newer version of PF_RING and if it<br>> > doesnt fix it, I will test Suricata 3.0RC2<br>> <br>> No need to test suricata 3.0rc2 it won't fix the issue. You better<br>> switch to another capture method.<br>> <br>> ++<br>> <br>> > <br>> > Thanks.<br>> > <br>> > > Date: Mon, 14 Dec 2015 16:34:14 +0100<br>> > > From: andi@geekosphere.org<br>> > > To: oisf-users@lists.openinfosecfoundation.org<br>> > > Subject: Re: [Oisf-users] suricata freezes if no or little traffic<br>> > is present on monitored interface<br>> > > <br>> > > On 14/12/15 at 15:30, Yasha Zislin wrote:<br>> > > > I am running CentOS 6 64 bit with suricata 2.1 beta4.I have not<br>> > tried<br>> > > > Suricata 3.0RC. I am curious to see if there is a way to fix that<br>> > on<br>> > > > my current version. Thank you. <br>> > > <br>> > > Could you try 3.0RC2 to see if it's solved in that version?<br>> > > This could save a lot of time investigating the issue if it's<br>> > resolved<br>> > > within 3.0RC2.<br>> > > <br>> > > -- <br>> > > Andreas Herz<br>> > > _______________________________________________<br>> > > Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.o<br>> > rg<br>> > > Site: http://suricata-ids.org | Support: http://suricata-ids.org/su<br>> > pport/<br>> > > List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf<br>> > -users<br>> > > Suricata User Conference November 4 & 5 in Barcelona: http://oisfev<br>> > ents.net<br>> > _______________________________________________<br>> > Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>> > Site: http://suricata-ids.org | Support: http://suricata-ids.org/supp<br>> > ort/<br>> > List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-u<br>> > sers<br>> > Suricata User Conference November 4 & 5 in Barcelona: http://oisfeven<br>> > ts.net<br>> -- <br>> Eric Leblond <eric@regit.org><br>> Blog: https://home.regit.org/<br>> <br>> <br></div></div> </div></body>
</html>