[Oisf-users] AF-Packet errors using 2 threads

[Peter Manev]

On Thu, Oct 9, 2014 at 7:46 AM, C. L. Martinez <carlopmart at gmail.com> wrote:
> On Wed, Oct 8, 2014 at 7:58 PM, Christophe Vandeplas
> <christophe at vandeplas.com> wrote:
>> On Wed, Oct 8, 2014 at 5:06 PM, C. L. Martinez <carlopmart at gmail.com> wrote:
>>> On Wed, Oct 8, 2014 at 2:45 PM, C. L. Martinez <carlopmart at gmail.com> wrote:
>>>> Hi all,
>>>>
>>>>  Whn I change af-packet config section to use 2 threads instead of 1,
>>>> I receive the following error:
>>>>
>>>> 8/10/2014 -- 14:38:21 - <Error> - [ERRCODE: SC_ERR_AFP_CREATE(190)] -
>>>> Coudn't set fanout mode, error Protocol not available
>>>> 8/10/2014 -- 14:38:21 - <Error> - [ERRCODE: SC_ERR_AFP_CREATE(190)] -
>>>> Couldn't init AF_PACKET socket, fatal error
>>>> 8/10/2014 -- 14:38:21 - <Notice> - Signal Received.  Stopping engine.
>>>> 8/10/2014 -- 14:38:21 - <Error> - [ERRCODE: SC_ERR_AFP_CREATE(190)] -
>>>> Coudn't set fanout mode, error Protocol not available
>>>> 8/10/2014 -- 14:38:21 - <Error> - [ERRCODE: SC_ERR_AFP_CREATE(190)] -
>>>> Couldn't init AF_PACKET socket, fatal error
>>>>
>>>> Uhmm .. what does it means?? What protocol is not available??
>>>
>>> Oops .. is this the reason:
>>>
>>> https://lists.openinfosecfoundation.org/pipermail/oisf-users/2013-November/003156.html
>>> ???
>>>
>>> I am using suricata 2.0.4 under a CentOS 6.5 host ...
>>
>> to know your kernel version enter "uname -a " in a shell.
>>
>
> Here it is:
>
> Linux idp01srv.domain.org 2.6.32-431.29.2.el6.x86_64 #1 SMP Tue Sep 9
> 21:36:05 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux\


Yes , that is the reason.
I would recommend at least 3.2 kernel level.

> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> Training now available: http://suricata-ids.org/training/



-- 
Regards,
Peter Manev