[Snort-users] Snort 2.9, RHEL 5 and afpacket DAQ
ralf at ...8096...
Mon Oct 18 14:28:22 EDT 2010
I am playing around with Snort 2.9.0 on RHEL 5. Using the DAQ libraries
with libpcap works fine. But the afpacket daq module always bails on
# snort --daq afpacket
Running in packet dump mode
--== Initializing Snort ==--
Initializing Output Plugins!
afpacket DAQ configured to passive.
Acquiring network traffic from "eth0".
--== Initialization Complete ==--
,,_ -*> Snort! <*-
o" )~ Version 2.9.0 (Build 68)
'''' By Martin Roesch & The Snort Team:
Copyright (C) 1998-2010 Sourcefire, Inc., et al.
Using libpcap version 1.1.1
Using PCRE version: 6.6 06-Feb-2006
Commencing packet processing (pid=3329)
ERROR: Can't start DAQ (-1) - create_rx_ring: Couldn't create kernel RX
ring on packet socket: Cannot allocate memory!
Fatal Error, Quitting..
It works fine on Fedora 13. I have searched the mailing lists but have
not found any clue. Does the kernel on RHEL 5 (2.6.18) not provide the
It would be fine if stated in the README or FAQ but I have not found
Any hints, clues, advices?
More information about the Snort-users