Re: possible to omit the -Q command line switch to enable inline daq mode?

Thanks Alexey - that did the trick.

------- Original Message -------
On Monday, December 5th, 2022 at 3:55 AM, Oleksii Shumeiko -X (oshumeik - SOFTSERVE INC at Cisco) <[email protected]> wrote:

> Hi, John.
>
> I presume, you need the whole snort in 'inline' mode. While ips.mode sets policy mode only.
> Adding the following lines to your configuration should do the trick:
> snort = {}
> snort["-Q"] = ''
>
> Note: some useful commands to check:
> snort --help-module snort | grep inline
> snort --help-module ips | grep inline
>
> Have a nice day,
> Alexey
>
>> On 2 Dec 2022, at 12:04, John via Snort-users <[email protected]> wrote:
>>
>> I am running snort3 on OpenWrt and trying to enable afpacket DAQ Inline mode directly from /etc/config/snort.lua thus omitting the -Q switch. I added the following to /etc/config/snort.lua but still, it starts in passive mode:
>>
>> ips ={
>> mode = inline, variables = default_variables,
>>
>> rules = [[
>> include $RULE_PATH/snort3-community.rules
>> ]]
>> }
>> daq = { module_dirs = {
>> '/usr/lib/daq',
>> },
>> modules = {
>> {
>> name = 'afpacket',
>> mode = 'inline',
>> variables = {
>> 'fanout_type=hash'
>> }
>> }
>> }
>> }
>>
>> Example:
>> # /usr/bin/snort -i eth0:eth1 -c /etc/snort/snort.lua
>> --------------------------------------------------o")~ Snort++ 3.1.47.0
>> --------------------------------------------------
>> ...
>> afpacket DAQ configured to passive.Commencing packet processing
>> ++ [0] eth0:eth1
>> _______________________________________________
>> Snort-users mailing list
>> [email protected]
>> Go to this URL to change user options or unsubscribe:
>> https://lists.snort.org/mailman/listinfo/snort-users
>>
>> To unsubscribe, send an email to:
>> [email protected]
>>
>> Please visit http://blog.snort.org to stay current on all the latest Snort news!
>>
>> Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette