[Oisf-users] Can't apply BPF from file when PF_RING enabled? 2.1beta3
Brian Keefer
chort at effu.se
Mon Feb 9 18:06:22 UTC 2015
I’m experiencing some strange behavior with 2.1beta3. When I specify an external BPF file, the filter fails to apply. When I copy & paste the exact same filter from the file and insert it as the value in the YAML config, it works. The error is from the PF_RING integration code, so maybe it’s a unique condition to PF_RING support?
Error when filter is set to file:
7/2/2015 -- 18:24:48 - <Info> - Set PF_RING bpf filter "/etc/suricata/bpf.filter" failed.
7/2/2015 -- 18:24:48 - <Info> - Set PF_RING bpf filter "/etc/suricata/bpf.filter" failed.
7/2/2015 -- 18:24:48 - <Info> - Set PF_RING bpf filter "/etc/suricata/bpf.filter" failed.
7/2/2015 -- 18:24:48 - <Info> - Set PF_RING bpf filter "/etc/suricata/bpf.filter" failed.
7/2/2015 -- 18:24:48 - <Info> - Set PF_RING bpf filter "/etc/suricata/bpf.filter" failed.
7/2/2015 -- 18:24:48 - <Info> - Set PF_RING bpf filter "/etc/suricata/bpf.filter" failed.
7/2/2015 -- 18:24:48 - <Info> - Set PF_RING bpf filter "/etc/suricata/bpf.filter" failed.
7/2/2015 -- 18:24:48 - <Info> - Set PF_RING bpf filter "/etc/suricata/bpf.filter" failed.
7/2/2015 -- 18:24:48 - <Info> - Set PF_RING bpf filter "/etc/suricata/bpf.filter" failed.
7/2/2015 -- 18:24:48 - <Info> - Set PF_RING bpf filter "/etc/suricata/bpf.filter" failed.
7/2/2015 -- 18:24:48 - <Info> - Set PF_RING bpf filter "/etc/suricata/bpf.filter" failed.
7/2/2015 -- 18:24:48 - <Info> - Set PF_RING bpf filter "/etc/suricata/bpf.filter" failed.
7/2/2015 -- 18:24:48 - <Info> - Set PF_RING bpf filter "/etc/suricata/bpf.filter" failed.
7/2/2015 -- 18:24:48 - <Info> - Set PF_RING bpf filter "/etc/suricata/bpf.filter" failed.
When same filter is specified as the value in YAML:
7/2/2015 -- 18:27:22 - <Info> - Adding interface eth1 from config file
7/2/2015 -- 18:27:22 - <Info> - Using flow cluster mode for PF_RING (iface eth1)
7/2/2015 -- 18:27:22 - <Info> - Going to use 14 thread(s)
7/2/2015 -- 18:27:22 - <Info> - preallocated 1024 packets. Total memory 3573760
7/2/2015 -- 18:27:22 - <Info> - (RxPFReth11) Using PF_RING v.6.0.2, interface eth1, cluster-id 93
7/2/2015 -- 18:27:22 - <Info> - VLAN disabled, setting cluster type to CLUSTER_FLOW_5_TUPLE
7/2/2015 -- 18:27:22 - <Info> - preallocated 1024 packets. Total memory 3573760
7/2/2015 -- 18:27:22 - <Info> - (RxPFReth12) Using PF_RING v.6.0.2, interface eth1, cluster-id 93
7/2/2015 -- 18:27:22 - <Info> - VLAN disabled, setting cluster type to CLUSTER_FLOW_5_TUPLE
7/2/2015 -- 18:27:22 - <Info> - preallocated 1024 packets. Total memory 3573760
7/2/2015 -- 18:27:22 - <Info> - (RxPFReth13) Using PF_RING v.6.0.2, interface eth1, cluster-id 93
7/2/2015 -- 18:27:22 - <Info> - VLAN disabled, setting cluster type to CLUSTER_FLOW_5_TUPLE
7/2/2015 -- 18:27:22 - <Info> - preallocated 1024 packets. Total memory 3573760
7/2/2015 -- 18:27:22 - <Info> - (RxPFReth14) Using PF_RING v.6.0.2, interface eth1, cluster-id 93
7/2/2015 -- 18:27:22 - <Info> - VLAN disabled, setting cluster type to CLUSTER_FLOW_5_TUPLE
7/2/2015 -- 18:27:22 - <Info> - preallocated 1024 packets. Total memory 3573760
7/2/2015 -- 18:27:22 - <Info> - (RxPFReth15) Using PF_RING v.6.0.2, interface eth1, cluster-id 93
7/2/2015 -- 18:27:22 - <Info> - VLAN disabled, setting cluster type to CLUSTER_FLOW_5_TUPLE
7/2/2015 -- 18:27:22 - <Info> - preallocated 1024 packets. Total memory 3573760
7/2/2015 -- 18:27:22 - <Info> - (RxPFReth16) Using PF_RING v.6.0.2, interface eth1, cluster-id 93
7/2/2015 -- 18:27:22 - <Info> - VLAN disabled, setting cluster type to CLUSTER_FLOW_5_TUPLE
7/2/2015 -- 18:27:22 - <Info> - preallocated 1024 packets. Total memory 3573760
7/2/2015 -- 18:27:22 - <Info> - (RxPFReth17) Using PF_RING v.6.0.2, interface eth1, cluster-id 93
7/2/2015 -- 18:27:22 - <Info> - VLAN disabled, setting cluster type to CLUSTER_FLOW_5_TUPLE
7/2/2015 -- 18:27:22 - <Info> - preallocated 1024 packets. Total memory 3573760
7/2/2015 -- 18:27:22 - <Info> - (RxPFReth18) Using PF_RING v.6.0.2, interface eth1, cluster-id 93
7/2/2015 -- 18:27:22 - <Info> - VLAN disabled, setting cluster type to CLUSTER_FLOW_5_TUPLE
7/2/2015 -- 18:27:22 - <Info> - preallocated 1024 packets. Total memory 3573760
7/2/2015 -- 18:27:22 - <Info> - (RxPFReth19) Using PF_RING v.6.0.2, interface eth1, cluster-id 93
7/2/2015 -- 18:27:22 - <Info> - VLAN disabled, setting cluster type to CLUSTER_FLOW_5_TUPLE
7/2/2015 -- 18:27:22 - <Info> - preallocated 1024 packets. Total memory 3573760
7/2/2015 -- 18:27:22 - <Info> - (RxPFReth110) Using PF_RING v.6.0.2, interface eth1, cluster-id 93
7/2/2015 -- 18:27:22 - <Info> - VLAN disabled, setting cluster type to CLUSTER_FLOW_5_TUPLE
7/2/2015 -- 18:27:22 - <Info> - preallocated 1024 packets. Total memory 3573760
7/2/2015 -- 18:27:22 - <Info> - (RxPFReth111) Using PF_RING v.6.0.2, interface eth1, cluster-id 93
7/2/2015 -- 18:27:22 - <Info> - VLAN disabled, setting cluster type to CLUSTER_FLOW_5_TUPLE
7/2/2015 -- 18:27:22 - <Info> - preallocated 1024 packets. Total memory 3573760
7/2/2015 -- 18:27:22 - <Info> - (RxPFReth112) Using PF_RING v.6.0.2, interface eth1, cluster-id 93
7/2/2015 -- 18:27:22 - <Info> - VLAN disabled, setting cluster type to CLUSTER_FLOW_5_TUPLE
7/2/2015 -- 18:27:22 - <Info> - preallocated 1024 packets. Total memory 3573760
7/2/2015 -- 18:27:22 - <Info> - (RxPFReth113) Using PF_RING v.6.0.2, interface eth1, cluster-id 93
7/2/2015 -- 18:27:22 - <Info> - VLAN disabled, setting cluster type to CLUSTER_FLOW_5_TUPLE
7/2/2015 -- 18:27:22 - <Info> - preallocated 1024 packets. Total memory 3573760
7/2/2015 -- 18:27:23 - <Info> - (RxPFReth114) Using PF_RING v.6.0.2, interface eth1, cluster-id 93
7/2/2015 -- 18:27:23 - <Info> - VLAN disabled, setting cluster type to CLUSTER_FLOW_5_TUPLE
7/2/2015 -- 18:27:23 - <Info> - RunModeIdsPfringWorkers initialised
Filter (redacted the IP addresses):
vlan && !(ether[14:2] & 0xfff == 35 and port ftp) && !(ether[14:2] & 0xfff == 39 and port ftp) && !(ether[14:2] & 0xfff == 40 and port ftp) && !(ether[14:2] & 0xfff == 41 and port ftp) && !(ether[14:2] & 0xfff == 51 and port ftp) && !(host 192.0.2.100 || host 192.0.2.20 || host 192.0.2.70 || host 192.0.2.80 || host 192.0.2.130 || host 192.0.2.109)
Build info:
This is Suricata version 2.1beta3 RELEASE
Features: PCAP_SET_BUFF LIBPCAP_VERSION_MAJOR=1 PF_RING AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK HAVE_NSS HAVE_LIBJANSSON TLS
SIMD support: SSE_4_2 SSE_4_1 SSE_3
Atomic intrisics: 1 2 4 8 16 byte(s)
64-bits, Little-endian architecture
GCC version 4.4.7 20120313 (Red Hat 4.4.7-4), C version 199901
compiled with -fstack-protector
compiled with _FORTIFY_SOURCE=2
L1 cache line size (CLS)=64
thread local storage method: __thread
compiled with LibHTP v0.5.16, linked against LibHTP v0.5.16
Suricata Configuration:
AF_PACKET support: yes
PF_RING support: yes
NFQueue support: no
NFLOG support: no
IPFW support: no
DAG enabled: no
Napatech enabled: no
Unix socket enabled: yes
Detection enabled: yes
libnss support: yes
libnspr support: yes
libjansson support: yes
Prelude support: no
PCRE jit: no
LUA support: no
libluajit: no
libgeoip: no
Non-bundled htp: no
Old barnyard2 support: no
CUDA enabled: no
Suricatasc install: yes
Unit tests enabled: no
Debug output enabled: no
Debug validation enabled: no
Profiling enabled: no
Profiling locks enabled: no
Coccinelle / spatch: no
Generic build parameters:
Installation prefix (--prefix): /usr/local
Configuration directory (--sysconfdir): /etc/suricata/
Log directory (--localstatedir) : /var/log/suricata/
Host: x86_64-unknown-linux-gnu
GCC binary: gcc
GCC Protect enabled: yes
GCC march native enabled: yes
GCC Profile enabled: no
--
chort
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 841 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20150209/36e1a7d8/attachment.pgp>
More information about the Oisf-users
mailing list