[Oisf-users] getting errors from suri "Coudn't set fanout mode"

[Russell Fulton]

I thought I would post this for the record so next time I do this and go to google I will find it.  ;)

When I started up suricata with AF_PACKET on a newly installed machine I got this error several times for each thread:

[ERRCODE: SC_ERR_AFP_CREATE(190)] - Couldn't set fanout mode, error Invalid argument


The problem was really simple — no definitions for the interface in /etc/network/interfaces for the monitoring interface.

Russell