Snort 3 ipfw multithreading errors
[email protected] Wed, 24 Oct 2018 11:08:55 +0300
| Newsgroups | gmane.comp.security.ids.snort.devel |
|---|---|
| Message-ID | <[email protected]> |
Hello, I use snort3 run option with multithreading and daq module ipfw and port 5000 but I cant start snort3 I was see error this ipfw DAQ configured to passive. Commencing packet processing ++ [0] ++ [1] ++ [2] Can't start DAQ (-1) - ipfw_daq_start: can't bind divert socket (Address already in use) Analyzer: Failed to start DAQ instance Can't start DAQ (-1) - ipfw_daq_start: can't bind divert socket (Address already in use) Analyzer: Failed to start DAQ instance -- [0] -- [2] Can you help with this error ? Freebsd Versions : FreeBSD snort 11.2-RELEASE-p4 Snort Versions : ,,_ -*> Snort++ <*- o" )~ Version 3.0.0 (Build 247) FreeBSD '''' By Martin Roesch & The Snort Team http://snort.org/contact#team Copyright (C) 2014-2018 Cisco and/or its affiliates. All rights reserved. Copyright (C) 1998-2013 Sourcefire, Inc., et al. Using DAQ version 2.2.2 Using LuaJIT version 2.0.5 Using OpenSSL 1.0.2p 14 Aug 2018 Using libpcap version 1.9.0-PRE-GIT Using PCRE version 8.41 2017-07-05 Using ZLIB version 1.2.11 Using FlatBuffers 1.8.0 Using Hyperscan version 4.7.0 2018-10-03 Using LZMA version 5.2.3 Run Command : /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua --daq ipfw --daq-var port=5000 -l /var/log/snort -k none -A alert_full -z 3 _______________________________________________ Snort-devel mailing list [email protected] https://lists.snort.org/mailman/listinfo/snort-devel Please visit http://blog.snort.org for the latest news about Snort!
snort_run.txt
(text/plain, 2.2 KB)
--------------------------------------------------
o")~ Snort++ 3.0.0-247
--------------------------------------------------
Loading /usr/local/snort/etc/snort/snort.lua:
ssh
pop
binder
stream_tcp
gtp_inspect
dce_http_proxy
stream_icmp
normalizer
ftp_server
stream_udp
search_engine
dce_smb
file_log
ips
rpc_decode
modbus
latency
wizard
reputation
Processing blacklist file /usr/local/snort/etc/snort/../../intel/ip-blacklist
Reputation entries loaded: 1382, invalid: 0, re-defined: 0 (from file /usr/local/snort/etc/snort/../../intel/ip-blacklist)
Processing whitelist file /usr/local/snort/etc/snort/../../intel/ip-whitelist
Reputation entries loaded: 0, invalid: 0, re-defined: 0 (from file /usr/local/snort/etc/snort/../../intel/ip-whitelist)
appid
file_id
ftp_data
smtp
back_orifice
port_scan
dce_http_server
dce_tcp
telnet
ssl
sip
classifications
http2_inspect
http_inspect
stream_user
stream_ip
dnp3
ftp_client
stream
references
arp_spoof
dns
dce_udp
imap
stream_file
Finished /usr/local/snort/etc/snort/snort.lua.
Loading builtin:
Finished builtin.
Loading rules:
Loading /usr/local/snort/etc/snort/../../rules/local.rules:
Finished /usr/local/snort/etc/snort/../../rules/local.rules.
Loading /usr/local/snort/etc/snort/../../rules/appid.rules:
Finished /usr/local/snort/etc/snort/../../rules/appid.rules.
Finished rules.
--------------------------------------------------
rule counts
total rules loaded: 3084
text rules: 2613
builtin rules: 471
option chains: 3084
chain headers: 2
--------------------------------------------------
port rule counts
tcp udp icmp ip
any 3083 0 1 0
total 3083 0 1 0
--------------------------------------------------
ipfw DAQ configured to passive.
Commencing packet processing
++ [0]
++ [1]
++ [2]
Can't start DAQ (-1) - ipfw_daq_start: can't bind divert socket (Address already in use)
Analyzer: Failed to start DAQ instance
Can't start DAQ (-1) - ipfw_daq_start: can't bind divert socket (Address already in use)
Analyzer: Failed to start DAQ instance
-- [0]
-- [2]