[Oisf-users] Myricom and Suricata

[Victor Julien]

On 27-08-18 22:26, Edgmand, Craig wrote:
> I edited the pcap entry in suricata.yaml
> 
> pcap:
>   - interface: p1p1
>     threads: 16
>     buffer-size: 2gb
>     promisc: no
> 
> I ran variations of this command..
> 
> # SNF_NUM_RINGS=16 SNF_DEBUG_MASK=3 SNF_DATARING_SIZE=4294967296
> SNF_DESCRING_SIZE=1073741824 /opt/suricata/bin/suricata -i p1p1 -c
> /opt/suricata/etc/suricata/suricata.yaml -v --runmode=workers
> 
> After running these you look at myri_counters it shows no packets using
> the sniffer interface.
> 
>                      SNF recv pkts:                    0
>                 SNF drop ring full:                    0
> 
> If you try to run the tests using the snf0 interface, suricata dies.

How does it die? Any errors?


> Any thoughts?  I have reviewed the documentation from Myricom and
> Suricata as well.
> 
> Thanks,

What happens if you replace -i p1p1 with --pcap=p1p1 ?



-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------