[Oisf-users] Suricata 2.0.4 crash on Freebsd with No Buffer space available message

[mali dorn]

Thanks for your attention. I've tried that and the same results happened.
crash is seen on the Suricata 3.0.1 too. It's worth to mention that I have
no problem when there is no related QoS and traffic shaping rules.

On Sat, Apr 23, 2016 at 11:38 AM, Peter Manev <petermanev at gmail.com> wrote:

> On Sat, Apr 23, 2016 at 9:01 AM, mali dorn <mailleest14 at gmail.com> wrote:
> > We use Suricata 2.0.4 on FreeBSD 9.2 (64-btis) in IPS mode (with IPFW)
> and
> > it works perfectly. However, when we limit bandwidth using PF and ALTQ,
> we
> > see instant crash of Suricata when the bandwidth reaches to its maximum.
> > Here is my pf rule
> > queue http-em0-out bandwidth 120Kb  hfsc (  upperlimit 120Kb )
> >
> > Following messages appear in log file.
> >
> > <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write to ipfw divert
> socket
> > failed: No buffer space available
> > <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write to ipfw divert
> socket
> > failed: No buffer space available
> > <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write to ipfw divert
> socket
> > failed: No buffer space available
> >
> > I was wondering what is the root cause of the problem?
> > Thanks in advance.
> >
>
> 2.0.4 is no longer supported.
> Can you try 3.0.1 - latest stable -
> https://suricata-ids.org/download/
>
> (install ref for FreeBSD 8, 9 & 10)
> https://redmine.openinfosecfoundation.org/projects/suricata/wiki/FreeBSD_8
>
>
> Thanks
>
> >
> > _______________________________________________
> > Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> > Site: http://suricata-ids.org | Support:
> http://suricata-ids.org/support/
> > List:
> https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> > Suricata User Conference November 9-11 in Washington, DC:
> > http://oisfevents.net
>
>
>
> --
> Regards,
> Peter Manev
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20160425/f66c56a2/attachment-0002.html>