<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Texto sin formato Car";
margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
span.TextosinformatoCar
{mso-style-name:"Texto sin formato Car";
mso-style-priority:99;
mso-style-link:"Texto sin formato";
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 3.0cm 70.85pt 3.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="ES" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoPlainText"><span lang="EN-GB">Hello Everyone,<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-GB">Upgrading to last 4.8 kernel do the trick and start OK, but still show the "System too old for tpacket v3 switching to v2"… what do this mean?<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoPlainText"><b><span lang="EN-GB" style="font-size:9.0pt;font-family:"Courier New"">20/12/2016 -- 09:26:54 - <Info> - 37 rule files processed. 11803 rules successfully loaded, 0 rules failed<o:p></o:p></span></b></p>
<p class="MsoPlainText"><b><span lang="EN-GB" style="font-size:9.0pt;font-family:"Courier New"">20/12/2016 -- 09:26:54 - <Info> - 11804 signatures processed. 1298 are IP-only rules, 4447 are inspecting packet payload, 7567 inspect application layer, 0 are decoder
event only<o:p></o:p></span></b></p>
<p class="MsoPlainText"><b><span lang="EN-GB" style="font-size:9.0pt;font-family:"Courier New"">20/12/2016 -- 09:26:56 - <Info> - Threshold config parsed: 0 rule(s) found<o:p></o:p></span></b></p>
<p class="MsoPlainText"><b><span lang="EN-GB" style="font-size:9.0pt;font-family:"Courier New"">20/12/2016 -- 09:26:56 - <Info> - fast output device (regular) initialized: fast.log<o:p></o:p></span></b></p>
<p class="MsoPlainText"><b><span lang="EN-GB" style="font-size:9.0pt;font-family:"Courier New"">20/12/2016 -- 09:26:56 - <Info> - eve-log output device (regular) initialized: eve.json<o:p></o:p></span></b></p>
<p class="MsoPlainText"><b><span lang="EN-GB" style="font-size:9.0pt;font-family:"Courier New"">20/12/2016 -- 09:26:56 - <Info> - stats output device (regular) initialized: stats.log<o:p></o:p></span></b></p>
<p class="MsoPlainText"><b><span lang="EN-GB" style="font-size:9.0pt;font-family:"Courier New"">20/12/2016 -- 09:26:56 -
<span style="background:yellow;mso-highlight:yellow"><Notice> - System too old for tpacket v3 switching to v2<o:p></o:p></span></span></b></p>
<p class="MsoPlainText"><b><span lang="EN-GB" style="font-size:9.0pt;font-family:"Courier New"">20/12/2016 -- 09:26:56 - <Info> - Going to use 16 thread(s)<o:p></o:p></span></b></p>
<p class="MsoPlainText"><b><span lang="EN-GB" style="font-size:9.0pt;font-family:"Courier New"">20/12/2016 -- 09:26:56 -<span style="background:yellow;mso-highlight:yellow"> <Notice> - System too old for tpacket v3 switching to v2</span><o:p></o:p></span></b></p>
<p class="MsoPlainText"><b><span lang="EN-GB" style="font-size:9.0pt;font-family:"Courier New"">20/12/2016 -- 09:26:56 - <Info> - Going to use 16 thread(s)<o:p></o:p></span></b></p>
<p class="MsoPlainText"><b><span lang="EN-GB" style="font-size:9.0pt;font-family:"Courier New"">20/12/2016 -- 09:26:57 - <Notice> - all 32 packet processing threads, 4 management threads initialized, engine started.<o:p></o:p></span></b></p>
<p class="MsoPlainText"><b><span lang="EN-GB" style="font-size:9.0pt;font-family:"Courier New"">20/12/2016 -- 09:27:04 - <Info> - All AFP capture threads are running.<o:p></o:p></span></b></p>
<p class="MsoPlainText"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-GB" style="mso-fareast-language:ES">Regards,<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="mso-fareast-language:ES"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span style="mso-fareast-language:ES">Sergio<o:p></o:p></span></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><span style="mso-fareast-language:ES">-----Mensaje original-----<br>
De: Oisf-users [mailto:oisf-users-bounces@lists.openinfosecfoundation.org] En nombre de Sergio Romero<br>
Enviado el: viernes, 16 de diciembre de 2016 11:06<br>
Para: oisf-users@lists.openinfosecfoundation.org<br>
Asunto: Re: [Oisf-users] AF-packet mode not working</span></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Hi Eric!<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Tried pf_ring but I believe that process less pkts than pcap, maybe I'm wrong.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">We'll try to update to 4.8 then and get back to you if all work as expected.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Thanks for your help.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Sergio<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-----Mensaje original-----<o:p></o:p></p>
<p class="MsoPlainText">De: Eric Leblond [<a href="mailto:eric@regit.org"><span style="color:windowtext;text-decoration:none">mailto:eric@regit.org</span></a>] Enviado el: viernes, 16 de diciembre de 2016 10:00<o:p></o:p></p>
<p class="MsoPlainText">Para: Sergio Romero <<a href="mailto:SRomero@nexica.net"><span style="color:windowtext;text-decoration:none">SRomero@nexica.net</span></a>>;
<a href="mailto:oisf-users@lists.openinfosecfoundation.org"><span style="color:windowtext;text-decoration:none">oisf-users@lists.openinfosecfoundation.org</span></a><o:p></o:p></p>
<p class="MsoPlainText">Asunto: Re: [Oisf-users] AF-packet mode not working<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Hi,<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">On Fri, 2016-12-16 at 08:29 +0000, Sergio Romero wrote:<o:p></o:p></p>
<p class="MsoPlainText">> Hello Eric,<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Tried with threads:auto and threads:8 with same results.<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Kernel it's a bit outdated 3.10.58-1.el6.elrepo.x86_64 from elrepo.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Wow, middle age is calling you.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">> Do you think that updating the kernel to last release (kernel-lt-<o:p></o:p></p>
<p class="MsoPlainText">> 3.10.104-1) or maybe upgrading to to ml one kernel-ml-4.8.13-1 or<o:p></o:p></p>
<p class="MsoPlainText">> kernel-ml-4.9.0-1 ?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">If you wanna keep 3.10 then use pcap or pfring capture method. If you can upgrade, then pick one of these two. Maybe 4.8.13 is a little bit more mature than the 4.9 so more change it is more stable.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">BR,<o:p></o:p></p>
<p class="MsoPlainText">--<o:p></o:p></p>
<p class="MsoPlainText">Eric<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Regards,<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> -----Mensaje original-----<o:p></o:p></p>
<p class="MsoPlainText">> De: Eric Leblond [<a href="mailto:eric@regit.org"><span style="color:windowtext;text-decoration:none">mailto:eric@regit.org</span></a>] Enviado el: viernes, 16 de
<o:p></o:p></p>
<p class="MsoPlainText">> diciembre de 2016 9:08<o:p></o:p></p>
<p class="MsoPlainText">> Para: Sergio Romero <<a href="mailto:SRomero@nexica.net"><span style="color:windowtext;text-decoration:none">SRomero@nexica.net</span></a>>;
<a href="mailto:oisf-users@lists.openinfose"><span style="color:windowtext;text-decoration:none">oisf-users@lists.openinfose</span></a>
<o:p></o:p></p>
<p class="MsoPlainText">> cfoundation.org<o:p></o:p></p>
<p class="MsoPlainText">> Asunto: Re: [Oisf-users] AF-packet mode not working<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Hi,<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> On Fri, 2016-12-16 at 07:54 +0000, Sergio Romero wrote:<o:p></o:p></p>
<p class="MsoPlainText">> > Hello everyone,<o:p></o:p></p>
<p class="MsoPlainText">> > <o:p></o:p></p>
<p class="MsoPlainText">> > Been trying to modify my setup with the new version, starting on<o:p></o:p></p>
<p class="MsoPlainText">> > af-<o:p></o:p></p>
<p class="MsoPlainText">> > packet mode but it's not working logging starting errors (already
<o:p></o:p></p>
<p class="MsoPlainText">> > tried the threads:1 solution for centos6 but with no change)<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Centos 6 should be able to run with multiple threads. What is the
<o:p></o:p></p>
<p class="MsoPlainText">> kernel version ?<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> > , the mode that works almost good is pcap but with +-40 %<o:p></o:p></p>
<p class="MsoPlainText">> > kernel_drops:<o:p></o:p></p>
<p class="MsoPlainText">> > <o:p></o:p></p>
<p class="MsoPlainText">> > Setup:<o:p></o:p></p>
<p class="MsoPlainText">> > · Suricata 3.2<o:p></o:p></p>
<p class="MsoPlainText">> > · Centos 6 x64<o:p></o:p></p>
<p class="MsoPlainText">> > · Kernel 3.10<o:p></o:p></p>
<p class="MsoPlainText">> > · 2 x XeonE5-2470 0 @ 2.30GHz (8 Cores with HT) --- 32 total
<o:p></o:p></p>
<p class="MsoPlainText">> > · 96GB RAM · 2 x Intel 82599ES 10-Gigabit cards ·
<o:p></o:p></p>
<p class="MsoPlainText">> > Sniffer-only<o:p></o:p></p>
<p class="MsoPlainText">> > <o:p></o:p></p>
<p class="MsoPlainText">> > AFpacket Config:<o:p></o:p></p>
<p class="MsoPlainText">> > <o:p></o:p></p>
<p class="MsoPlainText">> > - interface: eth2<o:p></o:p></p>
<p class="MsoPlainText">> > threads: 1<o:p></o:p></p>
<p class="MsoPlainText">> > cluster-id: 98<o:p></o:p></p>
<p class="MsoPlainText">> > cluster-type: cluster_flow<o:p></o:p></p>
<p class="MsoPlainText">> > defrag: yes<o:p></o:p></p>
<p class="MsoPlainText">> > use-mmap: yes<o:p></o:p></p>
<p class="MsoPlainText">> > ring-size: 300000<o:p></o:p></p>
<p class="MsoPlainText">> > <o:p></o:p></p>
<p class="MsoPlainText">> > - interface: eth3<o:p></o:p></p>
<p class="MsoPlainText">> > threads: 1<o:p></o:p></p>
<p class="MsoPlainText">> > cluster-id: 97<o:p></o:p></p>
<p class="MsoPlainText">> > cluster-type: cluster_flow<o:p></o:p></p>
<p class="MsoPlainText">> > defrag: yes<o:p></o:p></p>
<p class="MsoPlainText">> > use-mmap: yes<o:p></o:p></p>
<p class="MsoPlainText">> > ring-size: 300000<o:p></o:p></p>
<p class="MsoPlainText">> > <o:p></o:p></p>
<p class="MsoPlainText">> > Start errors:<o:p></o:p></p>
<p class="MsoPlainText">> > <o:p></o:p></p>
<p class="MsoPlainText">> > 14/12/2016 -- 17:12:42 - <Notice> - This is Suricata version 3.2
<o:p></o:p></p>
<p class="MsoPlainText">> > RELEASE<o:p></o:p></p>
<p class="MsoPlainText">> > 14/12/2016 -- 17:12:42 - <Info> - CPUs/cores online: 32<o:p></o:p></p>
<p class="MsoPlainText">> > 14/12/2016 -- 17:12:42 - <Info> - Use pid file /var/run/suricata.pid
<o:p></o:p></p>
<p class="MsoPlainText">> > from config file.<o:p></o:p></p>
<p class="MsoPlainText">> > 14/12/2016 -- 17:12:45 - <Info> - 37 rule files processed. 11788
<o:p></o:p></p>
<p class="MsoPlainText">> > rules successfully loaded, 0 rules failed<o:p></o:p></p>
<p class="MsoPlainText">> > 14/12/2016 -- 17:12:45 - <Info> - 11789 signatures processed. 1314
<o:p></o:p></p>
<p class="MsoPlainText">> > are IP-only rules, 4425 are inspecting packet payload, 7558 inspect
<o:p></o:p></p>
<p class="MsoPlainText">> > application layer, 0 are decoder event only<o:p></o:p></p>
<p class="MsoPlainText">> > 14/12/2016 -- 17:12:53 - <Info> - Threshold config parsed: 0<o:p></o:p></p>
<p class="MsoPlainText">> > rule(s)<o:p></o:p></p>
<p class="MsoPlainText">> > found<o:p></o:p></p>
<p class="MsoPlainText">> > 14/12/2016 -- 17:12:53 - <Info> - fast output device (regular)<o:p></o:p></p>
<p class="MsoPlainText">> > initialized: fast.log<o:p></o:p></p>
<p class="MsoPlainText">> > 14/12/2016 -- 17:12:53 - <Info> - eve-log output device (regular)<o:p></o:p></p>
<p class="MsoPlainText">> > initialized: eve.json<o:p></o:p></p>
<p class="MsoPlainText">> > 14/12/2016 -- 17:12:53 - <Info> - stats output device (regular)<o:p></o:p></p>
<p class="MsoPlainText">> > initialized: stats.log<o:p></o:p></p>
<p class="MsoPlainText">> > 14/12/2016 -- 17:12:53 - <Info> - Going to use 1 thread(s)<o:p></o:p></p>
<p class="MsoPlainText">> > 14/12/2016 -- 17:12:53 - <Info> - Going to use 1 thread(s)<o:p></o:p></p>
<p class="MsoPlainText">> > 14/12/2016 -- 17:12:55 - <Notice> - all 2 packet processing threads,<o:p></o:p></p>
<p class="MsoPlainText">> > 4 management threads initialized, engine started.<o:p></o:p></p>
<p class="MsoPlainText">> > 14/12/2016 -- 17:12:55 - <Error> - [ERRCODE:<o:p></o:p></p>
<p class="MsoPlainText">> > SC_ERR_INVALID_VALUE(130)] - Frame size bigger than block size<o:p></o:p></p>
<p class="MsoPlainText">> > 14/12/2016 -- 17:12:55 - <Info> - Ring parameter are incorrect.<o:p></o:p></p>
<p class="MsoPlainText">> > Please correct the devel<o:p></o:p></p>
<p class="MsoPlainText">> > 14/12/2016 -- 17:12:55 - <Error> - [ERRCODE:<o:p></o:p></p>
<p class="MsoPlainText">> > SC_ERR_AFP_CREATE(190)]<o:p></o:p></p>
<p class="MsoPlainText">> > - Couldn't init AF_PACKET socket, fatal error<o:p></o:p></p>
<p class="MsoPlainText">> > 14/12/2016 -- 17:12:55 - <Error> - [ERRCODE:<o:p></o:p></p>
<p class="MsoPlainText">> > SC_ERR_INVALID_VALUE(130)] - Frame size bigger than block size<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Update configuration to have a block-size variable and increase it
<o:p></o:p></p>
<p class="MsoPlainText">> till it works<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> - interface: eth2<o:p></o:p></p>
<p class="MsoPlainText">> threads: 1<o:p></o:p></p>
<p class="MsoPlainText">> cluster-id: 98<o:p></o:p></p>
<p class="MsoPlainText">> cluster-type: cluster_flow<o:p></o:p></p>
<p class="MsoPlainText">> defrag: yes<o:p></o:p></p>
<p class="MsoPlainText">> use-mmap: yes<o:p></o:p></p>
<p class="MsoPlainText">> ring-size: 300000<o:p></o:p></p>
<p class="MsoPlainText">> block-size: 32768<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Strange things is that it should not do that on a plain eth. What is
<o:p></o:p></p>
<p class="MsoPlainText">> the MTU on the iface ?<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Alternatively, you can also try to force capture to v2:<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> tpacket-v3: no<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> BR,<o:p></o:p></p>
<p class="MsoPlainText">> --<o:p></o:p></p>
<p class="MsoPlainText"><span lang="EN-GB">> Eric Leblond <</span><a href="mailto:eric@regit.org"><span lang="EN-GB" style="color:windowtext;text-decoration:none">eric@regit.org</span></a><span lang="EN-GB">><o:p></o:p></span></p>
<p class="MsoPlainText">> _______________________________________________<o:p></o:p></p>
<p class="MsoPlainText"><span lang="EN-GB">> Suricata IDS Users mailing list: </span>
<a href="mailto:oisf-users@openinfosecfoundation.org"><span lang="EN-GB" style="color:windowtext;text-decoration:none">oisf-users@openinfosecfoundation.org</span></a><span lang="EN-GB"><o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-GB">> Site: </span><a href="http://suricata-ids.org"><span lang="EN-GB" style="color:windowtext;text-decoration:none">http://suricata-ids.org</span></a><span lang="EN-GB"> | Support:
</span><a href="http://suricata-"><span lang="EN-GB" style="color:windowtext;text-decoration:none">http://suricata-</span></a><span lang="EN-GB">
<o:p></o:p></span></p>
<p class="MsoPlainText">> ids.org/support/<o:p></o:p></p>
<p class="MsoPlainText"><span lang="EN-GB">> List: </span><a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-u"><span lang="EN-GB" style="color:windowtext;text-decoration:none">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-u</span></a><span lang="EN-GB"><o:p></o:p></span></p>
<p class="MsoPlainText">> sers<o:p></o:p></p>
<p class="MsoPlainText">--<o:p></o:p></p>
<p class="MsoPlainText"><span lang="EN-GB">Eric Leblond <</span><a href="mailto:eric@regit.org"><span lang="EN-GB" style="color:windowtext;text-decoration:none">eric@regit.org</span></a><span lang="EN-GB">><o:p></o:p></span></p>
<p class="MsoPlainText">_______________________________________________<o:p></o:p></p>
<p class="MsoPlainText"><span lang="EN-GB">Suricata IDS Users mailing list: </span>
<a href="mailto:oisf-users@openinfosecfoundation.org"><span lang="EN-GB" style="color:windowtext;text-decoration:none">oisf-users@openinfosecfoundation.org</span></a><span lang="EN-GB"><o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-GB">Site: </span><a href="http://suricata-ids.org"><span lang="EN-GB" style="color:windowtext;text-decoration:none">http://suricata-ids.org</span></a><span lang="EN-GB"> | Support:
</span><a href="http://suricata-ids.org/support/"><span lang="EN-GB" style="color:windowtext;text-decoration:none">http://suricata-ids.org/support/</span></a><span lang="EN-GB"><o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-GB">List: </span><a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users"><span lang="EN-GB" style="color:windowtext;text-decoration:none">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</span></a><span lang="EN-GB"><o:p></o:p></span></p>
</div>
</body>
</html>