[Oisf-users] getting errors from suri "Coudn't set fanout mode"

[Leonard Jacobs]

I saw this error or something similar to it when the interface was not configured for that which is in af-packet setting in yaml.

-----Original Message-----
From: Oisf-users [mailto:oisf-users-bounces at lists.openinfosecfoundation.org] On Behalf Of Russell Fulton
Sent: Thursday, November 26, 2015 7:40 PM
To: oisf-users at lists.openinfosecfoundation.org
Subject: [Oisf-users] getting errors from suri "Coudn't set fanout mode"


I thought I would post this for the record so next time I do this and go to google I will find it.  ;)

When I started up suricata with AF_PACKET on a newly installed machine I got this error several times for each thread:

[ERRCODE: SC_ERR_AFP_CREATE(190)] - Couldn't set fanout mode, error Invalid argument


The problem was really simple — no definitions for the interface in /etc/network/interfaces for the monitoring interface.

Russell




_______________________________________________
Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
Suricata User Conference November 4 & 5 in Barcelona: http://oisfevents.net