[Oisf-users] Suricata Support #2181 - sc_err_syscall<50>: failure when trying to get MTU via ioctl for:\device\..: invalid argument (22)

[Suchomel, Jeff]

Hello,

Is there an update/fix for the above referenced support number?  When starting Suricata, I get the following message which I think is causing Suricata to not fully load:

(util-ioctl.c:106) <Warning> (GetIfaceMTU) -- [ERRCODE: SC_ERR_SYSCALL(50)] - Failure when trying to get MTU via ioctl for '\Device\NPF_{5DB0B6BB-.........E25}': Invalid argument (22)

Troubleshooting steps I have taken:

  *   Used this site to reconcile my util-ioctl.c file against the one provided on the website - resulted in no change.

https://github.com/OISF/suricata/commit/8ac48872a5a005bf97bb90cdc0ecf1fe620448a2

  *   Created a new util-ioctl.c file using the example from the site below - resulted in no change.

https://fossies.org/linux/suricata/src/util-ioctl.c

  *   Followed instructions on this site to change to single \'s in directory path for magic.mgc file in yaml.

https://redmine.openinfosecfoundation.org/issues/1148

I have been able to find on the Internet examples of other users getting the same error message, but have not been able to find a solution.

System details:
            Server - Windows 2016 Server
            Suricata version - 4.1.0-dev (rev 787473ec)

This is a fresh install of Suricata on the server (not an upgrade).  I have attached the current .yaml file and util-ioctl.c file, as well as a screen shot of the console when I start Suricata.

Please let me know if there is any other information I can provide to help me get Suricata working.

Thank you!

Jeff Suchomel
Network Security Analyst
HealthMarkets, Inc.

9151 Boulevard 26 ■ North Richland Hills, TX 76180
P (817) 255-3263
jeff.suchomel at hmkts.com<mailto:jeff.suchomel at hmkts.com> ■ www.HealthMarketsInc.com<http://www.healthmarketsinc.com/>

Confidentiality Notice: This email message may contain confidential or proprietary information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. HealthMarkets, Inc. is a holding company that includes insurance subsidiaries The Chesapeake Life Insurance Company(r) and Mid-West National Life Insurance Company of TennesseeSM, and a subsidiary distribution company HealthMarkets Insurance Agency, the d/b/a of Insphere Insurance Solutions(r).

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20181206/5862ab47/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: suricata.yaml
Type: application/octet-stream
Size: 74532 bytes
Desc: suricata.yaml
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20181206/5862ab47/attachment-0001.obj>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: util-ioctl.c
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20181206/5862ab47/attachment-0001.c>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Screenshot of Suricata startup on console with error message.PNG
Type: image/png
Size: 103193 bytes
Desc: Screenshot of Suricata startup on console with error message.PNG
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20181206/5862ab47/attachment-0001.png>