[Oisf-users] Can't apply BPF from file when PF_RING enabled? 2.1beta3
Peter Manev
petermanev at gmail.com
Mon Feb 9 22:15:14 UTC 2015
On Mon, Feb 9, 2015 at 7:06 PM, Brian Keefer <chort at effu.se> wrote:
> I’m experiencing some strange behavior with 2.1beta3. When I specify an external BPF file, the filter fails to apply. When I copy & paste the exact same filter from the file and insert it as the value in the YAML config, it works. The error is from the PF_RING integration code, so maybe it’s a unique condition to PF_RING support?
>
> Error when filter is set to file:
> 7/2/2015 -- 18:24:48 - <Info> - Set PF_RING bpf filter "/etc/suricata/bpf.filter" failed.
> 7/2/2015 -- 18:24:48 - <Info> - Set PF_RING bpf filter "/etc/suricata/bpf.filter" failed.
> 7/2/2015 -- 18:24:48 - <Info> - Set PF_RING bpf filter "/etc/suricata/bpf.filter" failed.
> 7/2/2015 -- 18:24:48 - <Info> - Set PF_RING bpf filter "/etc/suricata/bpf.filter" failed.
> 7/2/2015 -- 18:24:48 - <Info> - Set PF_RING bpf filter "/etc/suricata/bpf.filter" failed.
> 7/2/2015 -- 18:24:48 - <Info> - Set PF_RING bpf filter "/etc/suricata/bpf.filter" failed.
> 7/2/2015 -- 18:24:48 - <Info> - Set PF_RING bpf filter "/etc/suricata/bpf.filter" failed.
> 7/2/2015 -- 18:24:48 - <Info> - Set PF_RING bpf filter "/etc/suricata/bpf.filter" failed.
> 7/2/2015 -- 18:24:48 - <Info> - Set PF_RING bpf filter "/etc/suricata/bpf.filter" failed.
> 7/2/2015 -- 18:24:48 - <Info> - Set PF_RING bpf filter "/etc/suricata/bpf.filter" failed.
> 7/2/2015 -- 18:24:48 - <Info> - Set PF_RING bpf filter "/etc/suricata/bpf.filter" failed.
> 7/2/2015 -- 18:24:48 - <Info> - Set PF_RING bpf filter "/etc/suricata/bpf.filter" failed.
> 7/2/2015 -- 18:24:48 - <Info> - Set PF_RING bpf filter "/etc/suricata/bpf.filter" failed.
> 7/2/2015 -- 18:24:48 - <Info> - Set PF_RING bpf filter "/etc/suricata/bpf.filter" failed.
>
Just as a sanity check - what was the previous Suricata/pfring version
that was running without this problem for you?
> When same filter is specified as the value in YAML:
> 7/2/2015 -- 18:27:22 - <Info> - Adding interface eth1 from config file
> 7/2/2015 -- 18:27:22 - <Info> - Using flow cluster mode for PF_RING (iface eth1)
> 7/2/2015 -- 18:27:22 - <Info> - Going to use 14 thread(s)
> 7/2/2015 -- 18:27:22 - <Info> - preallocated 1024 packets. Total memory 3573760
> 7/2/2015 -- 18:27:22 - <Info> - (RxPFReth11) Using PF_RING v.6.0.2, interface eth1, cluster-id 93
> 7/2/2015 -- 18:27:22 - <Info> - VLAN disabled, setting cluster type to CLUSTER_FLOW_5_TUPLE
> 7/2/2015 -- 18:27:22 - <Info> - preallocated 1024 packets. Total memory 3573760
> 7/2/2015 -- 18:27:22 - <Info> - (RxPFReth12) Using PF_RING v.6.0.2, interface eth1, cluster-id 93
> 7/2/2015 -- 18:27:22 - <Info> - VLAN disabled, setting cluster type to CLUSTER_FLOW_5_TUPLE
> 7/2/2015 -- 18:27:22 - <Info> - preallocated 1024 packets. Total memory 3573760
> 7/2/2015 -- 18:27:22 - <Info> - (RxPFReth13) Using PF_RING v.6.0.2, interface eth1, cluster-id 93
> 7/2/2015 -- 18:27:22 - <Info> - VLAN disabled, setting cluster type to CLUSTER_FLOW_5_TUPLE
> 7/2/2015 -- 18:27:22 - <Info> - preallocated 1024 packets. Total memory 3573760
> 7/2/2015 -- 18:27:22 - <Info> - (RxPFReth14) Using PF_RING v.6.0.2, interface eth1, cluster-id 93
> 7/2/2015 -- 18:27:22 - <Info> - VLAN disabled, setting cluster type to CLUSTER_FLOW_5_TUPLE
> 7/2/2015 -- 18:27:22 - <Info> - preallocated 1024 packets. Total memory 3573760
> 7/2/2015 -- 18:27:22 - <Info> - (RxPFReth15) Using PF_RING v.6.0.2, interface eth1, cluster-id 93
> 7/2/2015 -- 18:27:22 - <Info> - VLAN disabled, setting cluster type to CLUSTER_FLOW_5_TUPLE
> 7/2/2015 -- 18:27:22 - <Info> - preallocated 1024 packets. Total memory 3573760
> 7/2/2015 -- 18:27:22 - <Info> - (RxPFReth16) Using PF_RING v.6.0.2, interface eth1, cluster-id 93
> 7/2/2015 -- 18:27:22 - <Info> - VLAN disabled, setting cluster type to CLUSTER_FLOW_5_TUPLE
> 7/2/2015 -- 18:27:22 - <Info> - preallocated 1024 packets. Total memory 3573760
> 7/2/2015 -- 18:27:22 - <Info> - (RxPFReth17) Using PF_RING v.6.0.2, interface eth1, cluster-id 93
> 7/2/2015 -- 18:27:22 - <Info> - VLAN disabled, setting cluster type to CLUSTER_FLOW_5_TUPLE
> 7/2/2015 -- 18:27:22 - <Info> - preallocated 1024 packets. Total memory 3573760
> 7/2/2015 -- 18:27:22 - <Info> - (RxPFReth18) Using PF_RING v.6.0.2, interface eth1, cluster-id 93
> 7/2/2015 -- 18:27:22 - <Info> - VLAN disabled, setting cluster type to CLUSTER_FLOW_5_TUPLE
> 7/2/2015 -- 18:27:22 - <Info> - preallocated 1024 packets. Total memory 3573760
> 7/2/2015 -- 18:27:22 - <Info> - (RxPFReth19) Using PF_RING v.6.0.2, interface eth1, cluster-id 93
> 7/2/2015 -- 18:27:22 - <Info> - VLAN disabled, setting cluster type to CLUSTER_FLOW_5_TUPLE
> 7/2/2015 -- 18:27:22 - <Info> - preallocated 1024 packets. Total memory 3573760
> 7/2/2015 -- 18:27:22 - <Info> - (RxPFReth110) Using PF_RING v.6.0.2, interface eth1, cluster-id 93
> 7/2/2015 -- 18:27:22 - <Info> - VLAN disabled, setting cluster type to CLUSTER_FLOW_5_TUPLE
> 7/2/2015 -- 18:27:22 - <Info> - preallocated 1024 packets. Total memory 3573760
> 7/2/2015 -- 18:27:22 - <Info> - (RxPFReth111) Using PF_RING v.6.0.2, interface eth1, cluster-id 93
> 7/2/2015 -- 18:27:22 - <Info> - VLAN disabled, setting cluster type to CLUSTER_FLOW_5_TUPLE
> 7/2/2015 -- 18:27:22 - <Info> - preallocated 1024 packets. Total memory 3573760
> 7/2/2015 -- 18:27:22 - <Info> - (RxPFReth112) Using PF_RING v.6.0.2, interface eth1, cluster-id 93
> 7/2/2015 -- 18:27:22 - <Info> - VLAN disabled, setting cluster type to CLUSTER_FLOW_5_TUPLE
> 7/2/2015 -- 18:27:22 - <Info> - preallocated 1024 packets. Total memory 3573760
> 7/2/2015 -- 18:27:22 - <Info> - (RxPFReth113) Using PF_RING v.6.0.2, interface eth1, cluster-id 93
> 7/2/2015 -- 18:27:22 - <Info> - VLAN disabled, setting cluster type to CLUSTER_FLOW_5_TUPLE
> 7/2/2015 -- 18:27:22 - <Info> - preallocated 1024 packets. Total memory 3573760
> 7/2/2015 -- 18:27:23 - <Info> - (RxPFReth114) Using PF_RING v.6.0.2, interface eth1, cluster-id 93
> 7/2/2015 -- 18:27:23 - <Info> - VLAN disabled, setting cluster type to CLUSTER_FLOW_5_TUPLE
> 7/2/2015 -- 18:27:23 - <Info> - RunModeIdsPfringWorkers initialised
>
> Filter (redacted the IP addresses):
> vlan && !(ether[14:2] & 0xfff == 35 and port ftp) && !(ether[14:2] & 0xfff == 39 and port ftp) && !(ether[14:2] & 0xfff == 40 and port ftp) && !(ether[14:2] & 0xfff == 41 and port ftp) && !(ether[14:2] & 0xfff == 51 and port ftp) && !(host 192.0.2.100 || host 192.0.2.20 || host 192.0.2.70 || host 192.0.2.80 || host 192.0.2.130 || host 192.0.2.109)
>
> Build info:
> This is Suricata version 2.1beta3 RELEASE
> Features: PCAP_SET_BUFF LIBPCAP_VERSION_MAJOR=1 PF_RING AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK HAVE_NSS HAVE_LIBJANSSON TLS
> SIMD support: SSE_4_2 SSE_4_1 SSE_3
> Atomic intrisics: 1 2 4 8 16 byte(s)
> 64-bits, Little-endian architecture
> GCC version 4.4.7 20120313 (Red Hat 4.4.7-4), C version 199901
> compiled with -fstack-protector
> compiled with _FORTIFY_SOURCE=2
> L1 cache line size (CLS)=64
> thread local storage method: __thread
> compiled with LibHTP v0.5.16, linked against LibHTP v0.5.16
>
> Suricata Configuration:
> AF_PACKET support: yes
> PF_RING support: yes
> NFQueue support: no
> NFLOG support: no
> IPFW support: no
> DAG enabled: no
> Napatech enabled: no
> Unix socket enabled: yes
> Detection enabled: yes
>
> libnss support: yes
> libnspr support: yes
> libjansson support: yes
> Prelude support: no
> PCRE jit: no
> LUA support: no
> libluajit: no
> libgeoip: no
> Non-bundled htp: no
> Old barnyard2 support: no
> CUDA enabled: no
>
> Suricatasc install: yes
>
> Unit tests enabled: no
> Debug output enabled: no
> Debug validation enabled: no
> Profiling enabled: no
> Profiling locks enabled: no
> Coccinelle / spatch: no
>
> Generic build parameters:
> Installation prefix (--prefix): /usr/local
> Configuration directory (--sysconfdir): /etc/suricata/
> Log directory (--localstatedir) : /var/log/suricata/
>
> Host: x86_64-unknown-linux-gnu
> GCC binary: gcc
> GCC Protect enabled: yes
> GCC march native enabled: yes
> GCC Profile enabled: no
>
> --
> chort
>
>
>
>
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> Training now available: http://suricata-ids.org/training/
--
Regards,
Peter Manev
More information about the Oisf-users
mailing list