[Oisf-users] AF_PACKET: fanout not supported on this system, falling back to 1 capture thread

[Victor Julien]

On 05-10-16 12:19, ltow at centrum.cz wrote:
>  /** \brief test if we can use FANOUT. Older kernels like those in
>   *         CentOS6 have HAVE_PACKET_FANOUT defined but fail to work
>   */
>  int AFPIsFanoutSupported(void)
>  {
>  #ifdef HAVE_PACKET_FANOUT
>      int fd = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
>      if (fd != -1) {
>          uint16_t mode = PACKET_FANOUT_HASH | PACKET_FANOUT_FLAG_DEFRAG;
>          uint16_t id = 99;
>          uint32_t option = (mode << 16) | (id & 0xffff);
>          int r = setsockopt(fd, SOL_PACKET, PACKET_FANOUT,(void *)&option, sizeof(option));
>          close(fd);
>  
>          if (r < 0) {
>              SCLogPerf("fanout not supported by kernel: %s", strerror(errno));
>              return 0;
>          }
>          return 1;
>      }
>  #endif
>      return 0;
>  }
> 
> And this check if failing on kernel 3.16 compiled with AF_PACKET support (or at least on stock Debian Jessie kernel):

I have been able to reproduce this on Debian Jessie. It seems to be
something about the kernel version, because another Jessie I have with
4.x kernel works fine.

It's a strange issue as setting the id (99 above) to 1 makes it work. Oh
well.

Fix pushed [1] and will be in 3.1.3.

Cheers,
Victor

[1]
https://github.com/inliniac/suricata/commit/534fc8748bdb8e10194ff9791c113b57be87adb8
-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------