[Oisf-users] Suricata 2.0.4 crash on Freebsd with No Buffer space available message

[Peter Manev]

On Sat, Apr 23, 2016 at 9:01 AM, mali dorn <mailleest14 at gmail.com> wrote:
> We use Suricata 2.0.4 on FreeBSD 9.2 (64-btis) in IPS mode (with IPFW) and
> it works perfectly. However, when we limit bandwidth using PF and ALTQ, we
> see instant crash of Suricata when the bandwidth reaches to its maximum.
> Here is my pf rule
> queue http-em0-out bandwidth 120Kb  hfsc (  upperlimit 120Kb )
>
> Following messages appear in log file.
>
> <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write to ipfw divert socket
> failed: No buffer space available
> <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write to ipfw divert socket
> failed: No buffer space available
> <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write to ipfw divert socket
> failed: No buffer space available
>
> I was wondering what is the root cause of the problem?
> Thanks in advance.
>

2.0.4 is no longer supported.
Can you try 3.0.1 - latest stable -
https://suricata-ids.org/download/

(install ref for FreeBSD 8, 9 & 10)
https://redmine.openinfosecfoundation.org/projects/suricata/wiki/FreeBSD_8


Thanks

>
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> Suricata User Conference November 9-11 in Washington, DC:
> http://oisfevents.net



-- 
Regards,
Peter Manev