Re: possible to omit the -Q command line switch to enable inline daq mode?

Hi, John.

I presume, you need the whole snort in 'inline' mode. While ips.mode sets policy mode only.
Adding the following lines to your configuration should do the trick:
snort = {}
snort["-Q"] = ''

Note: some useful commands to check:
snort --help-module snort | grep inline
snort --help-module ips | grep inline

Have a nice day,
Alexey

On 2 Dec 2022, at 12:04, John via Snort-users <[email protected]<mailto:[email protected]>> wrote:

I am running snort3 on OpenWrt and trying to enable afpacket DAQ Inline mode directly from /etc/config/snort.lua thus omitting the -Q switch.  I added the following to /etc/config/snort.lua but still, it starts in passive mode:

ips ={
    mode = inline,    variables = default_variables,

    rules = [[
        include $RULE_PATH/snort3-community.rules
  ]]
}
daq = {  module_dirs = {
    '/usr/lib/daq',
  },
  modules = {
    {
      name = 'afpacket',
      mode = 'inline',
      variables = {
        'fanout_type=hash'
      }
    }
  }
}

Example:
# /usr/bin/snort -i eth0:eth1 -c /etc/snort/snort.lua
--------------------------------------------------o")~   Snort++ 3.1.47.0
--------------------------------------------------
...
afpacket DAQ configured to passive.Commencing packet processing
++ [0] eth0:eth1
_______________________________________________
Snort-users mailing list
[email protected]<mailto:[email protected]>
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

To unsubscribe, send an email to:
[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette