<div dir="ltr">Hi Giuseppe,<div><br></div><div>Sorry, NFLOG seems to be working fine. I just confirmed iptables is catching intended packets and that tcpdump it picking them up via -i nflog:10.</div><div>I also confirmed that whether I use my nflog-enabled deb package, or manually do a ./configure --enable-nflog; make; make install, that I still get that fatal "[ERRCODE: SC_ERR_INVALID_ARGUMENT(13)] - initdata == NULL" line.</div><div>When I run "suricata --help", I see no reference to a --nflog option. Nor is there any reference to nflog at all in the man page.</div><div><div><br></div><div><br></div><div><div><font face="monospace, monospace">root@o-orlseim01-ptp:~# suricata -c /etc/suricata/suricata.yaml --nflog 10</font></div><div><font face="monospace, monospace">26/4/2018 -- 17:02:49 - <Notice> - This is Suricata version 4.0.4 RELEASE</font></div><div><font face="monospace, monospace">26/4/2018 -- 17:02:54 - <Error> - [ERRCODE: SC_ERR_INVALID_ARGUMENT(13)] - initdata == NULL</font></div><div><font face="monospace, monospace">26/4/2018 -- 17:02:54 - <Error> - [ERRCODE: SC_ERR_THREAD_INIT(49)] - thread "W#01-10" failed to initialize: flags 0145</font></div><div><font face="monospace, monospace">26/4/2018 -- 17:02:54 - <Error> - [ERRCODE: SC_ERR_INITIALIZATION(45)] - Engine initialization failed, aborting...</font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace">root@o-orlseim01-ptp:~# dmesg | tail</font></div><div><font face="monospace, monospace">[179774.299698] Process accounting resumed</font></div><div><font face="monospace, monospace">[266176.455815] Process accounting resumed</font></div><div><font face="monospace, monospace">[352578.755972] Process accounting resumed</font></div><div><font face="monospace, monospace">[376749.756539] SGI XFS with ACLs, security attributes, realtime, no debug enabled</font></div><div><font face="monospace, monospace">[376749.789166] JFS: nTxBlock = 8192, nTxLock = 65536</font></div><div><font face="monospace, monospace">[376749.817938] ntfs: driver 2.1.32 [Flags: R/O MODULE].</font></div><div><font face="monospace, monospace">[376749.880298] QNX4 filesystem 0.2.3 registered.</font></div><div><font face="monospace, monospace">[404679.648500] ip_tables: (C) 2000-2006 Netfilter Core Team</font></div><div><font face="monospace, monospace">[421657.536552] perf interrupt took too long (5003 > 5000), lowering kernel.perf_event_max_sample_rate to 25000</font></div><div><font face="monospace, monospace">[438980.143833] Process accounting resumed</font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace">root@o-orlseim01-ptp:~# iptables --list -v</font></div><div><font face="monospace, monospace">Chain INPUT (policy ACCEPT 1253K packets, 193M bytes)</font></div><div><font face="monospace, monospace"> pkts bytes target prot opt in out source destination</font></div><div><font face="monospace, monospace"> 2 120 NFLOG tcp -- any any anywhere anywhere tcp dpt:http nflog-group 10</font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace">Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)</font></div><div><font face="monospace, monospace"> pkts bytes target prot opt in out source destination</font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace">Chain OUTPUT (policy ACCEPT 1250K packets, 188M bytes)</font></div><div><font face="monospace, monospace"> pkts bytes target prot opt in out source destination</font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace">root@o-orlseim01-ptp:~# tcpdump -i nflog:10 -nn</font></div><div><font face="monospace, monospace">tcpdump: verbose output suppressed, use -v or -vv for full protocol decode</font></div><div><font face="monospace, monospace">listening on nflog:10, link-type NFLOG (Linux netfilter log messages), capture size 262144 bytes</font></div><div><font face="monospace, monospace">17:04:29.772337 IP 172.18.2.107.59519 > 10.18.0.144.80: Flags [S], seq 3035437428, win 14600, options [mss 1460,sackOK,TS val 542358755 ecr 0,nop,wscale 9], length 0</font></div><div><font face="monospace, monospace">17:04:32.916327 IP 172.18.2.107.59611 > 10.18.0.144.80: Flags [S], seq 4012452713, win 14600, options [mss 1460,sackOK,TS val 542361902 ecr 0,nop,wscale 9], length 0</font></div><div><font face="monospace, monospace">^C</font></div><div><font face="monospace, monospace">2 packets captured</font></div><div><font face="monospace, monospace">2 packets received by filter</font></div><div><font face="monospace, monospace">0 packets dropped by kernel</font></div></div><div><br></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Apr 26, 2018 at 3:43 PM, Giuseppe Longo <span dir="ltr"><<a href="mailto:lists@glongo.it" target="_blank">lists@glongo.it</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class=""><br>
<br>
On 26/04/2018 19:11, Kevin Branch wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Thanks for writing Giuseppe,<br>
<br>
I have already installed the nflog packages you mentioned, via apt, but when I run the new command line, it throws a new error:<br>
<br>
# suricata -c /etc/suricata/suricata.yaml --nflog<br>
26/4/2018 -- 13:03:06 - <Notice> - This is Suricata version 4.0.4 RELEASE<br>
26/4/2018 -- 13:03:11 - <Error> - [ERRCODE: SC_ERR_INVALID_ARGUMENT(13)] - initdata == NULL<br>
26/4/2018 -- 13:03:11 - <Error> - [ERRCODE: SC_ERR_THREAD_INIT(49)] - thread "W#01-10" failed to initialize: flags 0145<br>
26/4/2018 -- 13:03:11 - <Error> - [ERRCODE: SC_ERR_INITIALIZATION(45)] - Engine initialization failed, aborting...<br>
<br>
Does --nflog require some kind of argument?<br>
<br>
Pretty cryptic to me. Thanks for helping me take a look at this.<br>
<br>
Kevin<br>
<br>
<br>
</blockquote>
<br></span>
I believe there is something wrong in your setup,<br>
if you run 'iptables -L -v' do you see any packet<br>
matching your NFLOG group?<br>
<br>
See my case below:<br>
# iptables -L -v<br>
Chain INPUT (policy ACCEPT 9960 packets, 3694K bytes)<br>
pkts bytes target prot opt in out source destination<br>
9960 3694K NFLOG all -- any any anywhere anywhere<br>
<br>
If you can, try to flush iptables input chain with 'iptables -F'<br>
and try to add this rule: iptables -A INPUT -j NFLOG --nflog-group 10<br>
<br>
Take a look also at 'dmesg', make sure that there are no problem with nflog.<br>
<br>
Regards,<br>
Giuseppe<br>
</blockquote></div><br></div>