Re: Errors with BPF filter and DAQ

Please, any idea or help?


> On 28 Dec 2021, at 10:29, Carlos Lopez <[email protected]> wrote:
> 
> Hi all,
> 
> I am trying to filter some type of traffic using BPF under Snort 3.1.19.0. I have configured the following options in snort.lua:
> 
> packets =
> {
>    bpf_file = '/usr/local/etc/snort/bpf.conf',
> }
> 
> And my bpf file is pretty simple:
> 
> (ip and not proto 112)
> 
> … but when Snort starts returns the following error:
> 
> netmap DAQ configured to passive.
> initializing daemon mode
> child process is 70564
> Commencing packet processing
> FATAL: Couldn't set DAQ instance BPF filter to '(ip and not proto 112)
> ':  (-4)
> Fatal Error, Quitting..
> 
> Maybe do I need to pass this filter as a DAQ var?

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette