Re: Errors with BPF filter and DAQ

Hi Carlos,

Based on return error (-4: DAQ_ERROR_NOTSUP) and also looking into code, set_filter with bpf_file functionality for netmap module is not supported yet on libdaq.
currently, only pcap and afpacket module is supported with bpf_file option.

hope this answers your question.

Thanks,
Shashi


________________________________
From: Snort-users <[email protected]> on behalf of Carlos Lopez via Snort-users <[email protected]>
Sent: Thursday, December 30, 2021 6:17 AM
To: [email protected] <[email protected]>
Subject: Re: [Snort-users] Errors with BPF filter and DAQ

Please, any idea or help?


> On 28 Dec 2021, at 10:29, Carlos Lopez <[email protected]> wrote:
>
> Hi all,
>
> I am trying to filter some type of traffic using BPF under Snort 3.1.19.0. I have configured the following options in snort.lua:
>
> packets =
> {
>    bpf_file = '/usr/local/etc/snort/bpf.conf',
> }
>
> And my bpf file is pretty simple:
>
> (ip and not proto 112)
>
> … but when Snort starts returns the following error:
>
> netmap DAQ configured to passive.
> initializing daemon mode
> child process is 70564
> Commencing packet processing
> FATAL: Couldn't set DAQ instance BPF filter to '(ip and not proto 112)
> ':  (-4)
> Fatal Error, Quitting..
>
> Maybe do I need to pass this filter as a DAQ var?

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        [email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette