[Oisf-users] Suricata Support #2181 - sc_err_syscall<50>: failure when trying to get MTU via ioctl for:\device\..: invalid argument (22)

[Peter Manev]

On Thu, Dec 6, 2018 at 9:48 PM Suchomel, Jeff <Jeff.Suchomel at hmkts.com> wrote:
>
> Hello,
>
>
>
> Is there an update/fix for the above referenced support number?  When starting Suricata, I get the following message which I think is causing Suricata to not fully load:
>
>
>
> (util-ioctl.c:106) <Warning> (GetIfaceMTU) -- [ERRCODE: SC_ERR_SYSCALL(50)] - Failure when trying to get MTU via ioctl for '\Device\NPF_{5DB0B6BB-………E25}': Invalid argument (22)
>
>
>
> Troubleshooting steps I have taken:
>
> Used this site to reconcile my util-ioctl.c file against the one provided on the website – resulted in no change.
>
> https://github.com/OISF/suricata/commit/8ac48872a5a005bf97bb90cdc0ecf1fe620448a2
>
> Created a new util-ioctl.c file using the example from the site below – resulted in no change.
>
> https://fossies.org/linux/suricata/src/util-ioctl.c
>
> Followed instructions on this site to change to single \’s in directory path for magic.mgc file in yaml.
>
> https://redmine.openinfosecfoundation.org/issues/1148
>
>
>
> I have been able to find on the Internet examples of other users getting the same error message, but have not been able to find a solution.
>
>

Which Suricata version are you using (just for confirmation) - when
using the official Windows msi  - https://suricata-ids.org/download/


I can not reproduce the error you are reporting (full log form a
Windows 2016 server) -
https://pastebin.com/2DUvRss1


Thank you
>
> System details:
>
>             Server – Windows 2016 Server
>
>             Suricata version - 4.1.0-dev (rev 787473ec)
>
>
>
> This is a fresh install of Suricata on the server (not an upgrade).  I have attached the current .yaml file and util-ioctl.c file, as well as a screen shot of the console when I start Suricata.
>
>
>
> Please let me know if there is any other information I can provide to help me get Suricata working.
>
>
>
> Thank you!
>
>
>
> Jeff Suchomel
>
> Network Security Analyst
>
> HealthMarkets, Inc.
>
>
>
> 9151 Boulevard 26 ■ North Richland Hills, TX 76180
>
> P (817) 255-3263
>
> jeff.suchomel at hmkts.com ■ www.HealthMarketsInc.com
>
>
>
> Confidentiality Notice: This email message may contain confidential or proprietary information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. HealthMarkets, Inc. is a holding company that includes insurance subsidiaries The Chesapeake Life Insurance Company® and Mid-West National Life Insurance Company of TennesseeSM, and a subsidiary distribution company HealthMarkets Insurance Agency, the d/b/a of Insphere Insurance Solutions®.
>
>
>
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>
> Conference: https://suricon.net
> Trainings: https://suricata-ids.org/training/



-- 
Regards,
Peter Manev