[Oisf-users] interface won't enter promiscuous mode when run suricata with --pfring

[Delta Yeh]

If I change the macro  in source-pfring.c
#define LIBPFRING_REENTRANT   0

to

#define LIBPFRING_REENTRANT   1

it works.

Why I do this is because I notice that with new pfring_open, flags
 PF_RING_REENTRANT | PF_RING_LONG_HEADER | PF_RING_PROMISC
is set, but with old pfring_open, the   LIBPFRING_REENTRANT is 0.


So my question now is why LIBPFRING_REENTRANT affect promiscuous  mode?


2012/8/9 Delta Yeh <delta.yeh at gmail.com>:
> Hi,
>     When I run suricata 1.3rc1 with --pfring, the interface won't
> enter promiscuous mode.
>     I have to set interface promiscuous mode manually with ifconfig to
> make suricata works.
>     The pfring I use  is 5.2.1 , the OS is debian 5.
>
>     If I start suricata with pcap , everything is OK.
>
>     Any suggestion?
>
>     Thanks  in advance.
>
>
>
>    BR
> DeltaY