<html><head></head><body>I do not want to use af-packet mode. This sensor is not in-line. It is on a span port. I want af-packet disabled.<div><br></div><div>I installed it with a PPA.</div><div><br></div><div>Thanks.</div><div><br></div><div>Leonard<br><br><br><div><strong>
From:
</strong>
Andreas Herz <andi@geekosphere.org>
<br>
<strong>
To:
</strong>
<oisf-users@lists.openinfosecfoundation.org>
<br>
<strong>
Sent:
</strong>
1/22/2020 5:17 PM
<br>
<strong>
Subject:
</strong>
Re: [Oisf-users] Getting Errors on Suricata Startup
<br><br><blockquote class="mori" style="margin:0 0 0 .8ex;border-left:1px solid #CCC;padding-left:1ex;">Hi Leonard,<br><br>first of all, please reply to the mailinglist not to me directly.<br><br>On 22/01/20 at 15:20, Leonard Jacobs wrote:<br>> If I run Suricata in daemon mode I don’t get the error. Except sometimes I get a pid file error if don’t delete /var/run/Suricata.pid file first.<br><br>This is another issue but should be handled by the way the mode is run<br>from your system to take care of those pid files.<br><br>> I get the error below when running sudo /usr/bin/suricata -c /etc/suricata/suricata.yaml -i eno2 &.<br>> <br>> I have attached the Suricata.yaml file.<br><br>I would suggest you add some configuration settings to the af-packet<br>interface settings in the configuration file, ideally with interface<br>eno2 or at least for a default interface. Currently no af-packet<br>settings are in your config file.<br><br>Andi<br><br>-- <br>Andreas Herz<br>_______________________________________________<br>Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br><br>Conference: https://suricon.net<br>Trainings: https://suricata-ids.org/training/</blockquote></div></div></body></html>