Errors with BPF filter and DAQ
Carlos Lopez via Snort-users <[email protected]>
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <[email protected]> |
Hi all,
I am trying to filter some type of traffic using BPF under Snort 3.1.19.0. I have configured the following options in snort.lua:
packets =
{
bpf_file = '/usr/local/etc/snort/bpf.conf',
}
And my bpf file is pretty simple:
(ip and not proto 112)
… but when Snort starts returns the following error:
netmap DAQ configured to passive.
initializing daemon mode
child process is 70564
Commencing packet processing
FATAL: Couldn't set DAQ instance BPF filter to '(ip and not proto 112)
': (-4)
Fatal Error, Quitting..
Maybe do I need to pass this filter as a DAQ var?
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users
To unsubscribe, send an email to:
[email protected]
Please visit http://blog.snort.org to stay current on all the latest Snort news!
Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette