Re: Snort live IDS/IPS mode
"Oleksii Shumeiko -X \(oshumeik - SOFTSERVE INC at Cisco\) via Snort-users" <[email protected]> Fri, 13 Oct 2023 08:38:26 +0000
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <[email protected]> |
I think, afpacket expects two interfaces (a pair) to make snort inline. snort -c <conf> -q -Q --daq afpacket -i "<igress>:<egress>" Regards, Alexey On 12 Oct 2023, at 19:55, Joel Esler via Snort-users <[email protected]<mailto:[email protected]>> wrote: That’s a different error. Now you have permissions to access the interface, but you’re attempting to access an interface (eno0)? That doesn’t exist. On Oct 11, 2023, at 10:53 PM, abrar khan <[email protected]<mailto:[email protected]>> wrote: When i have logged in as root and run the command i still see the same error message root@snort3:/home/snorty/snort3# bin/snort -c /home/snorty/snort3/etc/snort/snort.lua -q -Q --daq afpacket -i eno0 -A cmg Couldn't construct a DAQ instance: create_instance: Could not find index for device eno0 (-1) root@snort3:/home/snorty/snort3# Is the above command the correct commands to run snort in live IDS/IPS mode? Thank you, Abrar Khan On Wednesday, October 11, 2023 at 02:32:55 PM CDT, Joel Esler <[email protected]<mailto:[email protected]>> wrote: Need to be root? — Sent from my iPhone On Oct 11, 2023, at 15:12, abrar khan via Snort-users <[email protected]<mailto:[email protected]>> wrote: Hello, I am on mac running ventura 13.0 and pulled down ciscotalos/snort3 image. I am trying to run this command logged in as snorty but i am getting an error. snorty@snort3:~$ snort -c /home/snorty/snort3/etc/snort/snort.lua -q -Q --daq afpacket -i eno0 -A cmg Couldn't construct a DAQ instance: create_instance: Could not open the PF_PACKET socket: Operation not permitted (-1) What do you i need change in order run snort live ? Thank you, Abrar Khan _______________________________________________ Snort-users mailing list [email protected]<mailto:[email protected]> Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected]<mailto:[email protected]> Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette _______________________________________________ Snort-users mailing list [email protected]<mailto:[email protected]> Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette _______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette