Re: Errors with BPF filter and DAQ

Now you have a filter syntax error and it looks like you've wrapped your bpf in single quotes. Try removing the single quotes from your filter expression.
________________________________
From: Carlos Lopez <[email protected]>
Sent: Wednesday, January 19, 2022 6:03 AM
To: Russ Combs (rucombs) <[email protected]>
Cc: [email protected] <[email protected]>; [email protected] <[email protected]>
Subject: Re: [Snort-users] Errors with BPF filter and DAQ

Hmm…. it fails:

bpf:netmap DAQ configured to passive.
initializing daemon mode
child process is 95311
Commencing packet processing
FATAL: Couldn't set DAQ instance BPF filter to ''(ip and not proto 112)'
': bpf_daq_set_filter: BPF state machine compilation failed! (-1)
Fatal Error, Quitting..


On 18 Jan 2022, at 17:05, Russ Combs (rucombs) <[email protected]<mailto:[email protected]>> wrote:

DAQ 3 supports the concept of module stacks and wrapper modules. See the Snort 3 user manual for details. In this case you would want something like:

$ snort --daq netmap [optional netmap daq vars] --daq bpf

This makes BPF available with any DAQ 3 module. The pcap and afpacket modules supports BPF natively and don't require the bpf wrapper. The others do.
________________________________
From: Snort-users <[email protected]<mailto:[email protected]>> on behalf of James Lay <[email protected]<mailto:[email protected]>>
Sent: Tuesday, January 18, 2022 10:40 AM
To: Carlos Lopez <[email protected]<mailto:[email protected]>>
Cc: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>>
Subject: Re: [Snort-users] Errors with BPF filter and DAQ

Try to pass it command line instead.

James

On 2022-01-18 08:27, Carlos Lopez wrote:
> No … According to another user in this mailing list, BPF filters are
> not supported by daq when netmap is used on nics ..
>
>> On 17 Jan 2022, at 17:29, James Lay <[email protected]<mailto:[email protected]>>
>> wrote:
>>
>> Did you get this resolved?
>>
>> On Thu, 2021-12-30 at 11:17 +0000, Carlos Lopez via Snort-users
>> wrote:
>>
>> Please, any idea or help?
>>
>> On 28 Dec 2021, at 10:29, Carlos Lopez <
>>
>> [email protected]<mailto:[email protected]>
>>
>>> wrote:
>>
>> Hi all,
>>
>> I am trying to filter some type of traffic using BPF under Snort
>> 3.1.19.0. I have configured the following options in snort.lua:
>>
>> packets =
>>
>> {
>>
>> bpf_file = '/usr/local/etc/snort/bpf.conf',
>>
>> }
>>
>> And my bpf file is pretty simple:
>>
>> (ip and not proto 112)
>>
>> … but when Snort starts returns the following error:
>>
>> netmap DAQ configured to passive.
>>
>> initializing daemon mode
>>
>> child process is 70564
>>
>> Commencing packet processing
>>
>> FATAL: Couldn't set DAQ instance BPF filter to '(ip and not proto
>> 112)
>>
>> ':  (-4)
>>
>> Fatal Error, Quitting..
>>
>> Maybe do I need to pass this filter as a DAQ var?
>>
>> _______________________________________________
>>
>> Snort-users mailing list
>>
>> [email protected]<mailto:[email protected]>
>>
>> Go to this URL to change user options or unsubscribe:
>>
>> https://lists.snort.org/mailman/listinfo/snort-users
>>
>> To unsubscribe, send an email to:
>>
>> [email protected]<mailto:[email protected]>
>>
>> Please visit
>>
>> http://blog.snort.org<http://blog.snort.org/>
>>
>> to stay current on all the latest Snort news!
>>
>> Please follow these rules:
>>
>> https://snort.org/faq/what-is-the-mailing-list-etiquette
>
>  _______________________________________________
> Snort-users mailing list
> [email protected]<mailto:[email protected]>
> Go to this URL to change user options or unsubscribe:
> https://lists.snort.org/mailman/listinfo/snort-users
>
> To unsubscribe, send an email to:
> [email protected]<mailto:[email protected]>
>
> Please visit http://blog.snort.org<http://blog.snort.org/> to stay current on all the latest
> Snort news!
>
> Please follow these rules:
> https://snort.org/faq/what-is-the-mailing-list-etiquette
_______________________________________________
Snort-users mailing list
[email protected]<mailto:[email protected]>
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        [email protected]<mailto:[email protected]>

Please visit http://blog.snort.org<http://blog.snort.org/> to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette