[Oisf-users] AF_PACKET: fanout not supported on this system, falling back to 1 capture thread

[Victor Julien]

On 05-10-16 01:04, ltow at centrum.cz wrote:
> using stop Debian Jessie kernel:
> 
> root at mirach:~# uname -a
> Linux mirach 3.16.0-4-amd64 #1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03) x86_64 GNU/Linux
> 
> and jessie-backport Suricata package:
> 
> root at mirach:~# suricata -V
> This is Suricata version 3.1.2 RELEASE
> 
> I am not able to use AF_PACKET fanout, as check for fanout is failing and only one detect thread is started instead:
> 
> root at mirach:~# suricata -c /etc/suricata/suricata.yaml --af-packet=eth2 --runmode workers -vvvvv
> ......
> 5/10/2016 -- 00:47:59 - <Info> - Unified2-alert initialized: filename unified2.alert, limit 32 MB
> 5/10/2016 -- 00:47:59 - <Info> - stats output device (regular) initialized: stats.log
> 5/10/2016 -- 00:47:59 - <Notice> - fanout not supported on this system, falling back to 1 capture thread

It looks like this was checked during compilation of the packet ports
package. Jessie should support fanout though, so not sure why it doesn't
work. Maybe it's something weird in the package building process.

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------