<div dir="ltr">I am specifying it at run time. My suricata.log has nothing indicating method of acquisition... wether I use afpacket or pfring. All I have, other than the startup message, is an event message indicating that all packet processing threads, management threads initialized,, engine started. </div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Nov 16, 2016 at 2:00 PM, Andreas Moe <span dir="ltr"><<a href="mailto:moe.andreas@gmail.com" target="_blank">moe.andreas@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I know that it was previously in the stats.log, but that has been changed, to make a more uniform logging format, for many different reasons. But, what i was trying to convey, was that in the suricata application log, it should indicate what kind of packet acquisition method is being utilized. AKA, the suricata.log should say if either AF-PACKET or PF_RING is being used. But then again, why are you not specifiing this when starting Suricata? You cannot use them at the same time.</div><div class="HOEnZb"><div class="h5"><br><div class="gmail_quote"><div dir="ltr">ons. 16. nov. 2016 kl. 19.55 skrev erik clark <<a href="mailto:philosnef@gmail.com" target="_blank">philosnef@gmail.com</a>>:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr" class="m_6029318256708635460gmail_msg">No. Previously this was in stats.log. Right now I have zero ways of telling if pf_ring or af_packet is being properly used. :)<div class="m_6029318256708635460gmail_msg"><br class="m_6029318256708635460gmail_msg"></div><div class="m_6029318256708635460gmail_msg"><a href="https://home.regit.org/2012/07/suricata-to-10gbps-and-beyond/" class="m_6029318256708635460gmail_msg" target="_blank">https://home.regit.org/2012/<wbr>07/suricata-to-10gbps-and-<wbr>beyond/</a><br class="m_6029318256708635460gmail_msg"></div><div class="m_6029318256708635460gmail_msg"><br class="m_6029318256708635460gmail_msg"></div><div class="m_6029318256708635460gmail_msg"><br class="m_6029318256708635460gmail_msg"></div><div class="m_6029318256708635460gmail_msg"><pre class="m_6029318256708635460m_2331282302509052199gmail-literal-block m_6029318256708635460gmail_msg" style="margin-top:1.5em;margin-bottom:1.5em;padding:1em;border:1px solid rgb(221,221,221);outline:0px;font-size:13.92px;font-family:"courier new",courier,monaco,"lucida console",monospace;overflow:auto;background-color:rgb(247,247,247);line-height:1.5em;border-radius:5px;color:rgb(0,0,0)">capture.kernel_packets | AFPacketeth315 | 1436331302
capture.kernel_drops | AFPacketeth315 | 0
capture.kernel_packets | AFPacketeth316 | 1449320230
capture.kernel_drops | AFPacketeth316 | 0</pre></div></div><div class="gmail_extra m_6029318256708635460gmail_msg"><br class="m_6029318256708635460gmail_msg"><div class="gmail_quote m_6029318256708635460gmail_msg">On Wed, Nov 16, 2016 at 1:51 PM, Andreas Moe <span dir="ltr" class="m_6029318256708635460gmail_msg"><<a href="mailto:moe.andreas@gmail.com" class="m_6029318256708635460gmail_msg" target="_blank">moe.andreas@gmail.com</a>></span> wrote:<br class="m_6029318256708635460gmail_msg"><blockquote class="gmail_quote m_6029318256708635460gmail_msg" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p dir="ltr" class="m_6029318256708635460gmail_msg">Shouldnt suricata logging (suricata.log if enabled, and not sure of what verbose level needed) indicate what acquisition method is used?</p>
<br class="m_6029318256708635460gmail_msg"><div class="gmail_quote m_6029318256708635460gmail_msg"><div class="m_6029318256708635460gmail_msg"><div class="m_6029318256708635460m_2331282302509052199h5 m_6029318256708635460gmail_msg"><div dir="ltr" class="m_6029318256708635460gmail_msg">Den ons. 16. nov. 2016, 19:45 skrev erik clark <<a href="mailto:philosnef@gmail.com" class="m_6029318256708635460gmail_msg" target="_blank">philosnef@gmail.com</a>>:<br class="m_6029318256708635460gmail_msg"></div></div></div><blockquote class="gmail_quote m_6029318256708635460gmail_msg" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="m_6029318256708635460gmail_msg"><div class="m_6029318256708635460m_2331282302509052199h5 m_6029318256708635460gmail_msg"><div dir="ltr" class="m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_6029318256708635460gmail_msg">Ok, so I can't tell if either pfring or afpacket is actually being used by suricata. Previous versions of suricata had AFPacket in the stats.log indicating one or the other is loaded. Now, all it says:<div class="m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_6029318256708635460gmail_msg"><br class="m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_6029318256708635460gmail_msg"></div><div class="m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_6029318256708635460gmail_msg">(stat) | W#12-em3 | (value)</div><div class="m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_6029318256708635460gmail_msg"><br class="m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_6029318256708635460gmail_msg"></div><div class="m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_6029318256708635460gmail_msg">How can I tell that either afpacket or pfring is _actually_ being used as expected, when nothing in the stats.log file indicates that this is the case? Thanks!</div><div class="m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_6029318256708635460gmail_msg"><br class="m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_6029318256708635460gmail_msg"></div></div></div></div>
______________________________<wbr>_________________<br class="m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_6029318256708635460gmail_msg">
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" class="m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_6029318256708635460gmail_msg" target="_blank">oisf-users@<wbr>openinfosecfoundation.org</a><br class="m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_6029318256708635460gmail_msg">
Site: <a href="http://suricata-ids.org" rel="noreferrer" class="m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_6029318256708635460gmail_msg" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" rel="noreferrer" class="m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_6029318256708635460gmail_msg" target="_blank">http://suricata-ids.org/<wbr>support/</a><br class="m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_6029318256708635460gmail_msg">
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" class="m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_6029318256708635460gmail_msg" target="_blank">https://lists.<wbr>openinfosecfoundation.org/<wbr>mailman/listinfo/oisf-users</a><br class="m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_6029318256708635460gmail_msg">
Suricata User Conference November 9-11 in Washington, DC: <a href="http://suricon.net" rel="noreferrer" class="m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_6029318256708635460gmail_msg" target="_blank">http://suricon.net</a></blockquote></div>
</blockquote></div><br class="m_6029318256708635460gmail_msg"></div>
</blockquote></div>
</div></div></blockquote></div><br></div>