Re: Issues running snort 3 in multi threaded mode.
Fatih USTA via Snort-users <[email protected]>
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <[email protected]> |
Hi Snort3 doesn't support multi thread with nfq mod. I asked same question before. https://github.com/snort3/snort3/issues/164#issuecomment-804597085 Fatih USTA On 30.03.2022 09:03, Andrew Welham wrote: > Dear All, > > I'm trying to run snort 3 in multi threaded mode. As i only appear to > have a single thread with maxes out at 100% cpu utilisation, when > other cores in the servers are not utilised. > I am running using NFQUEUE as i also have a firewall on the same router. > > I added -z 4 to the command i use. > > /usr/local/bin/snort -c /usr/local/etc/snort/snort.lua -s 65535 -k > none -l /var/log/snort -D -m 0x1b -Q -z 4 > > > Although snort launches i get the following errors, and snort while > working does not run in multithreaded mode. > > nfq DAQ configured to inline. > initializing daemon mode > child process is 39280 > Commencing packet processing > # ++ [0] 0 > ++ [1] 0 > ++ [2] 0 > ++ [3] 0 > Error receiving message from the DAQ instance: nfq_daq_msg_receive: > Netlink message processing failed: -1 - Operation not permitted (1) > -- [1] 0 > Error receiving message from the DAQ instance: nfq_daq_msg_receive: > Netlink message processing failed: -1 - Operation not permitted (1) > Error receiving message from the DAQ instance: nfq_daq_msg_receive: > Netlink message processing failed: -1 - Operation not permitted (1) > -- [3] 0 > -- [2] 0 > > > Is it possible to run snort 3 in multi threaded mode with NFQUEUE. > Have i made some type of config error > > > Many Thanks > _______________________________________________ > Snort-users mailing list > [email protected] > Go to this URL to change user options or unsubscribe: > https://lists.snort.org/mailman/listinfo/snort-users > > To unsubscribe, send an email to: > [email protected] > > Please visit http://blog.snort.org to stay current on all the latest > Snort news! > > Please follow these rules: > https://snort.org/faq/what-is-the-mailing-list-etiquette _______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette