[Oisf-users] getting errors from suri "Coudn't set fanout mode"

[Russell Fulton]

> On 27 Nov 2015, at 15:39, Leonard Jacobs <ljacobs at netsecuris.com> wrote:
> 
> I saw this error or something similar to it when the interface was not configured for that which is in af-packet setting in yaml.

yes, it seems to be the message you get when the target interface does not exist or is misconfigured.

> 
> -----Original Message-----
> From: Oisf-users [mailto:oisf-users-bounces at lists.openinfosecfoundation.org] On Behalf Of Russell Fulton
> Sent: Thursday, November 26, 2015 7:40 PM
> To: oisf-users at lists.openinfosecfoundation.org
> Subject: [Oisf-users] getting errors from suri "Coudn't set fanout mode"
> 
> 
> I thought I would post this for the record so next time I do this and go to google I will find it.  ;)
> 
> When I started up suricata with AF_PACKET on a newly installed machine I got this error several times for each thread:
> 
> [ERRCODE: SC_ERR_AFP_CREATE(190)] - Couldn't set fanout mode, error Invalid argument
> 
> 
> The problem was really simple — no definitions for the interface in /etc/network/interfaces for the monitoring interface.
> 
> Russell
> 
> 
> 
> 
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> Suricata User Conference November 4 & 5 in Barcelona: http://oisfevents.net
>