<div dir="ltr">Aha! Excellent. Yes, I see that it is spawning AF_PACKET properly in the -vv output to console. The only engry in suricata.log that might be relevant though is "All AFP capture threads are running.". If this is supposed to mean AF_PACKET, could we get that clarified in a future release? <div><br></div><div>PF_RING shows up properly with -vv, but apparently not without it. </div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Nov 16, 2016 at 2:07 PM, Andreas Moe <span dir="ltr"><<a href="mailto:moe.andreas@gmail.com" target="_blank">moe.andreas@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Have you tried increasing the verbosity of the logging? add "-vv" as a commandline flag when you run Suricata.</div><div class="HOEnZb"><div class="h5"><br><div class="gmail_quote"><div dir="ltr">ons. 16. nov. 2016 kl. 20.05 skrev erik clark <<a href="mailto:philosnef@gmail.com" target="_blank">philosnef@gmail.com</a>>:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr" class="m_2246495127964677112gmail_msg">I am specifying it at run time. My suricata.log has nothing indicating method of acquisition... wether I use afpacket or pfring. All I have, other than the startup message, is an event message indicating that all packet processing threads, management threads initialized,, engine started. </div><div class="gmail_extra m_2246495127964677112gmail_msg"><br class="m_2246495127964677112gmail_msg"><div class="gmail_quote m_2246495127964677112gmail_msg">On Wed, Nov 16, 2016 at 2:00 PM, Andreas Moe <span dir="ltr" class="m_2246495127964677112gmail_msg"><<a href="mailto:moe.andreas@gmail.com" class="m_2246495127964677112gmail_msg" target="_blank">moe.andreas@gmail.com</a>></span> wrote:<br class="m_2246495127964677112gmail_msg"><blockquote class="gmail_quote m_2246495127964677112gmail_msg" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr" class="m_2246495127964677112gmail_msg">I know that it was previously in the stats.log, but that has been changed, to make a more uniform logging format, for many different reasons. But, what i was trying to convey, was that in the suricata application log, it should indicate what kind of packet acquisition method is being utilized. AKA, the suricata.log should say if either AF-PACKET or PF_RING is being used. But then again, why are you not specifiing this when starting Suricata? You cannot use them at the same time.</div><div class="m_2246495127964677112m_5673065402231893271HOEnZb m_2246495127964677112gmail_msg"><div class="m_2246495127964677112m_5673065402231893271h5 m_2246495127964677112gmail_msg"><br class="m_2246495127964677112gmail_msg"><div class="gmail_quote m_2246495127964677112gmail_msg"><div dir="ltr" class="m_2246495127964677112gmail_msg">ons. 16. nov. 2016 kl. 19.55 skrev erik clark <<a href="mailto:philosnef@gmail.com" class="m_2246495127964677112gmail_msg" target="_blank">philosnef@gmail.com</a>>:<br class="m_2246495127964677112gmail_msg"></div><blockquote class="gmail_quote m_2246495127964677112gmail_msg" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr" class="m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg">No. Previously this was in stats.log. Right now I have zero ways of telling if pf_ring or af_packet is being properly used. :)<div class="m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg"><br class="m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg"></div><div class="m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg"><a href="https://home.regit.org/2012/07/suricata-to-10gbps-and-beyond/" class="m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg" target="_blank">https://home.regit.org/2012/<wbr>07/suricata-to-10gbps-and-<wbr>beyond/</a><br class="m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg"></div><div class="m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg"><br class="m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg"></div><div class="m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg"><br class="m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg"></div><div class="m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg"><pre class="m_2246495127964677112m_5673065402231893271m_6029318256708635460m_2331282302509052199gmail-literal-block m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg" style="margin-top:1.5em;margin-bottom:1.5em;padding:1em;border:1px solid rgb(221,221,221);outline:0px;font-size:13.92px;font-family:"courier new",courier,monaco,"lucida console",monospace;overflow:auto;background-color:rgb(247,247,247);line-height:1.5em;border-radius:5px;color:rgb(0,0,0)">capture.kernel_packets | AFPacketeth315 | 1436331302
capture.kernel_drops | AFPacketeth315 | 0
capture.kernel_packets | AFPacketeth316 | 1449320230
capture.kernel_drops | AFPacketeth316 | 0</pre></div></div><div class="gmail_extra m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg"><br class="m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg"><div class="gmail_quote m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg">On Wed, Nov 16, 2016 at 1:51 PM, Andreas Moe <span dir="ltr" class="m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg"><<a href="mailto:moe.andreas@gmail.com" class="m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg" target="_blank">moe.andreas@gmail.com</a>></span> wrote:<br class="m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg"><blockquote class="gmail_quote m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p dir="ltr" class="m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg">Shouldnt suricata logging (suricata.log if enabled, and not sure of what verbose level needed) indicate what acquisition method is used?</p>
<br class="m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg"><div class="gmail_quote m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg"><div class="m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg"><div class="m_2246495127964677112m_5673065402231893271m_6029318256708635460m_2331282302509052199h5 m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg"><div dir="ltr" class="m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg">Den ons. 16. nov. 2016, 19:45 skrev erik clark <<a href="mailto:philosnef@gmail.com" class="m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg" target="_blank">philosnef@gmail.com</a>>:<br class="m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg"></div></div></div><blockquote class="gmail_quote m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg"><div class="m_2246495127964677112m_5673065402231893271m_6029318256708635460m_2331282302509052199h5 m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg"><div dir="ltr" class="m_2246495127964677112m_5673065402231893271m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg">Ok, so I can't tell if either pfring or afpacket is actually being used by suricata. Previous versions of suricata had AFPacket in the stats.log indicating one or the other is loaded. Now, all it says:<div class="m_2246495127964677112m_5673065402231893271m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg"><br class="m_2246495127964677112m_5673065402231893271m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg"></div><div class="m_2246495127964677112m_5673065402231893271m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg">(stat) | W#12-em3 | (value)</div><div class="m_2246495127964677112m_5673065402231893271m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg"><br class="m_2246495127964677112m_5673065402231893271m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg"></div><div class="m_2246495127964677112m_5673065402231893271m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg">How can I tell that either afpacket or pfring is _actually_ being used as expected, when nothing in the stats.log file indicates that this is the case? Thanks!</div><div class="m_2246495127964677112m_5673065402231893271m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg"><br class="m_2246495127964677112m_5673065402231893271m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg"></div></div></div></div>
______________________________<wbr>_________________<br class="m_2246495127964677112m_5673065402231893271m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg">
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" class="m_2246495127964677112m_5673065402231893271m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg" target="_blank">oisf-users@<wbr>openinfosecfoundation.org</a><br class="m_2246495127964677112m_5673065402231893271m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg">
Site: <a href="http://suricata-ids.org" rel="noreferrer" class="m_2246495127964677112m_5673065402231893271m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" rel="noreferrer" class="m_2246495127964677112m_5673065402231893271m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg" target="_blank">http://suricata-ids.org/<wbr>support/</a><br class="m_2246495127964677112m_5673065402231893271m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg">
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" class="m_2246495127964677112m_5673065402231893271m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg" target="_blank">https://lists.<wbr>openinfosecfoundation.org/<wbr>mailman/listinfo/oisf-users</a><br class="m_2246495127964677112m_5673065402231893271m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg">
Suricata User Conference November 9-11 in Washington, DC: <a href="http://suricon.net" rel="noreferrer" class="m_2246495127964677112m_5673065402231893271m_6029318256708635460m_2331282302509052199m_-5861063854257505270gmail_msg m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg" target="_blank">http://suricon.net</a></blockquote></div>
</blockquote></div><br class="m_2246495127964677112m_5673065402231893271m_6029318256708635460gmail_msg m_2246495127964677112gmail_msg"></div>
</blockquote></div>
</div></div></blockquote></div><br class="m_2246495127964677112gmail_msg"></div>
</blockquote></div>
</div></div></blockquote></div><br></div>