possible to omit the -Q command line switch to enable inline daq mode?

John via Snort-users <[email protected]>
Newsgroups gmane.comp.security.ids.snort.general
Message-ID <aR4EugD2X5THRHJeNyviapoACdQM_mVCWWINlHgBNeQ7XWSvnzhXP2BeZEvES3ZgCSSxGy5_zLArNLbbQni5572dOQKlnA_AsNyH0eMaD8g=@proton.me>
I am running snort3 on OpenWrt and trying to enable afpacket DAQ Inline mode directly from /etc/config/snort.lua thus omitting the -Q switch.  I added the following to /etc/config/snort.lua but still, it starts in passive mode:

ips ={
    mode = inline,    variables = default_variables,

    rules = [[
        include $RULE_PATH/snort3-community.rules
  ]]
}
daq = {  module_dirs = {
    '/usr/lib/daq',
  },
  modules = {
    {
      name = 'afpacket',
      mode = 'inline',
      variables = {
        'fanout_type=hash'
      }
    }
  }
}

Example:
# /usr/bin/snort -i eth0:eth1 -c /etc/snort/snort.lua
--------------------------------------------------o")~   Snort++ 3.1.47.0
--------------------------------------------------
...
afpacket DAQ configured to passive.Commencing packet processing
++ [0] eth0:eth1
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.