possible to omit the -Q command line switch to enable inline daq mode?
John via Snort-users <[email protected]>
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <aR4EugD2X5THRHJeNyviapoACdQM_mVCWWINlHgBNeQ7XWSvnzhXP2BeZEvES3ZgCSSxGy5_zLArNLbbQni5572dOQKlnA_AsNyH0eMaD8g=@proton.me> |
I am running snort3 on OpenWrt and trying to enable afpacket DAQ Inline mode directly from /etc/config/snort.lua thus omitting the -Q switch. I added the following to /etc/config/snort.lua but still, it starts in passive mode:
ips ={
mode = inline, variables = default_variables,
rules = [[
include $RULE_PATH/snort3-community.rules
]]
}
daq = { module_dirs = {
'/usr/lib/daq',
},
modules = {
{
name = 'afpacket',
mode = 'inline',
variables = {
'fanout_type=hash'
}
}
}
}
Example:
# /usr/bin/snort -i eth0:eth1 -c /etc/snort/snort.lua
--------------------------------------------------o")~ Snort++ 3.1.47.0
--------------------------------------------------
...
afpacket DAQ configured to passive.Commencing packet processing
++ [0] eth0:eth1
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users
To unsubscribe, send an email to:
[email protected]
Please visit http://blog.snort.org to stay current on all the latest Snort news!
Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette