[Oisf-users] AF-Packet errors using 2 threads

[C. L. Martinez]

On Thu, Oct 9, 2014 at 5:54 AM, Peter Manev <petermanev at gmail.com> wrote:
> On Thu, Oct 9, 2014 at 7:46 AM, C. L. Martinez <carlopmart at gmail.com> wrote:
>> On Wed, Oct 8, 2014 at 7:58 PM, Christophe Vandeplas
>> <christophe at vandeplas.com> wrote:
>>> On Wed, Oct 8, 2014 at 5:06 PM, C. L. Martinez <carlopmart at gmail.com> wrote:
>>>> On Wed, Oct 8, 2014 at 2:45 PM, C. L. Martinez <carlopmart at gmail.com> wrote:
>>>>> Hi all,
>>>>>
>>>>>  Whn I change af-packet config section to use 2 threads instead of 1,
>>>>> I receive the following error:
>>>>>
>>>>> 8/10/2014 -- 14:38:21 - <Error> - [ERRCODE: SC_ERR_AFP_CREATE(190)] -
>>>>> Coudn't set fanout mode, error Protocol not available
>>>>> 8/10/2014 -- 14:38:21 - <Error> - [ERRCODE: SC_ERR_AFP_CREATE(190)] -
>>>>> Couldn't init AF_PACKET socket, fatal error
>>>>> 8/10/2014 -- 14:38:21 - <Notice> - Signal Received.  Stopping engine.
>>>>> 8/10/2014 -- 14:38:21 - <Error> - [ERRCODE: SC_ERR_AFP_CREATE(190)] -
>>>>> Coudn't set fanout mode, error Protocol not available
>>>>> 8/10/2014 -- 14:38:21 - <Error> - [ERRCODE: SC_ERR_AFP_CREATE(190)] -
>>>>> Couldn't init AF_PACKET socket, fatal error
>>>>>
>>>>> Uhmm .. what does it means?? What protocol is not available??
>>>>
>>>> Oops .. is this the reason:
>>>>
>>>> https://lists.openinfosecfoundation.org/pipermail/oisf-users/2013-November/003156.html
>>>> ???
>>>>
>>>> I am using suricata 2.0.4 under a CentOS 6.5 host ...
>>>
>>> to know your kernel version enter "uname -a " in a shell.
>>>
>>
>> Here it is:
>>
>> Linux idp01srv.domain.org 2.6.32-431.29.2.el6.x86_64 #1 SMP Tue Sep 9
>> 21:36:05 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux\
>
>
> Yes , that is the reason.
> I would recommend at least 3.2 kernel level.
>

Understood. Many thanks to all.