Re: NFQ question

Hi Gustaf!

You can try without the -D option, it will help you check for daq initialization errors if any.
Snort 3 is written in such a way that it is daemonized before the packet threads start running, so if some kind of daq nfq initialization error occurs, you will not see it.

Thanks,
Vitalii!

From: Snort-users <[email protected]> on behalf of Gustaf Florén via Snort-users <[email protected]>
Date: Monday, 12 February 2024 at 16:15
To: [email protected] <[email protected]>
Subject: [Snort-users] NFQ question
Hello!

I'am trying to run snort 3 as an unprivilieged user snort.Below are my configurations:

Create the group "snort":
  sudo groupadd snort

Create user "snort" and add the user to group "snort":
 sudo useradd snort -s /bin/bash -g snort

Set a password for user "snort":
 sudo passwd snort

Set ownership and permissions:
  sudo chown -R snort:snort /usr/local/etc/snort
  sudo chown -R snort:snort /var/log/snort
  sudo chmod 400 /usr/local/etc/snort/{snort.lua,snort_defaults.lua}
  sudo chmod -R 5755 /var/log/snort

Add user snort to group netdev:
 sudo usermod -a -G netdev snort
 sudo usermod -a -G sudo snort

I get no errors when attempting to start snort with:

sudo /usr/local/bin/snort -c /usr/local/etc/snort/snort.lua --daq-dir /usr/local/lib/daq --daq nfq --daq-mode inline -s 65535 -k none -l /var/log/snort -Q -D --plugin-path /usr/local/etc/snort/extra --tweaks max_detect -u snort -g snort

Here are the output when attempting to start snort:

nfq DAQ configured to inline.
initializing daemon mode
child process is 5054
Commencing packet processing
++ [0] 1

Then I do "ps aux| grep snort" and no snort process has been started.

Any ideas??

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette