<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>Did you initiate af-packet in your Suricata start up command using --af-packet on the end of command? I don't see that in your message.</div><div id="AppleMailSignature"><br></div><div id="AppleMailSignature"><a href="https://home.regit.org/2012/09/new-af_packet-ips-mode-in-suricata/">https://home.regit.org/2012/09/new-af_packet-ips-mode-in-suricata/</a><br><br>Sent from my iPhone</div><div><br>On Jun 27, 2016, at 5:25 PM, mostafa ammar <<a href="mailto:mostafaammar79@gmail.com">mostafaammar79@gmail.com</a>> wrote:<br><br></div><blockquote type="cite"><div><div dir="ltr"><div><div>Dear All,<br><br></div>I am newbie to suricata , i installed suricata and now it is running but i cannot see any logs for a<br></div> and captruring i can see traffic on eth0 (I am running suricata on it), I added rule to detect pings in emerging-dos.rules and it is not generating any logs .<br><br><div>also i see am erorr on interface is this error cause of the problem<br><br>kindly find the <br>sudo suricata -c /usr/local/etc/suricata/suricata.yaml -i eth0 --init-errors-fatal<br>[16193] 28/6/2016 -- 00:09:40 - (suricata.c:1086) <Notice> (SCPrintVersion) -- This is Suricata version 3.1dev (rev 4111331)<br>[16193] 28/6/2016 -- 00:09:43 - (util-ioctl.c:341) <Warning> (GetIfaceOffloadingLinux) -- [ERRCODE: SC_ERR_NIC_OFFLOADING(284)] - NIC offloading on eth0: SG: SET, GRO: SET, LRO: unset, TSO: SET, GSO: SET. Run: ethtool -K eth0 sg off gro off lro off tso off gso off<br>[16193] 28/6/2016 -- 00:09:43 - (runmode-af-packet.c:447) <Warning> (ParseAFPConfig) -- [ERRCODE: SC_ERR_AFP_CREATE(190)] - Using AF_PACKET with offloading activated leads to capture problems<br>[16193] 28/6/2016 -- 00:09:43 - (tm-threads.c:2168) <Notice> (TmThreadWaitOnThreadInit) -- all 1 packet processing threads, 4 management threads initialized, engine started.<br><br><br></div></div>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a></span><br><span>Site: <a href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a></span><br><span>List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a></span><br><span>Suricata User Conference November 9-11 in Washington, DC: <a href="http://oisfevents.net">http://oisfevents.net</a></span></div></blockquote></body></html>