Re: Snort live IDS/IPS mode

 When i have logged in as root and run the command i still see the same error message
root@snort3:/home/snorty/snort3# bin/snort -c /home/snorty/snort3/etc/snort/snort.lua -q -Q --daq afpacket -i eno0 -A cmg

Couldn't construct a DAQ instance: create_instance: Could not find index for device eno0 (-1)

root@snort3:/home/snorty/snort3# 

Is the above command the correct commands to run snort in live IDS/IPS mode? 
Thank you,Abrar Khan
    On Wednesday, October 11, 2023 at 02:32:55 PM CDT, Joel Esler <[email protected]> wrote:  
 
 Need to be root?

— Sent from my iPhone

On Oct 11, 2023, at 15:12, abrar khan via Snort-users <[email protected]> wrote:



Hello,I am on mac running ventura 13.0 and pulled down ciscotalos/snort3 image. I am trying to run this command logged in as snorty but i am getting an error.

snorty@snort3:~$ snort -c /home/snorty/snort3/etc/snort/snort.lua -q -Q --daq afpacket -i eno0 -A cmg

Couldn't construct a DAQ instance: create_instance: Could not open the PF_PACKET socket: Operation not permitted (-1)

What do you i need change in order run snort live ?
Thank you,Abrar Khan
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

    To unsubscribe, send an email to:
    [email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette