[Snort-users] Problem with Snort3 multi-threaded on FreeBSD

Dalten 22 Dalten22 at hotmail.com
Thu Nov 30 12:14:20 EST 2017


FreeBSD 11.1 amd64 - 4 cores
DAQ: Netmap

Background:  I have Snort3 is running very well with the following command:  snort -c /opt/snort/etc/snort/snort.lua -i igb0:igb1 --daq netmap -Q -u snort -g snort &

While that works well enough, if I tell it to use 4 threads like so, I get some errors in the console after about 10 seconds.

snort -c /opt/snort/etc/snort/snort.lua -i igb0:igb1 --daq netmap -Q -u snort -g snort -z 4 &

Commencing packet processing
++ [0] igb0:igb1
++ [1] igb0:igb1
++ [2] igb0:igb1
++ [3] igb0:igb1
Set GID to 8888
Set UID to 8888
Can't acquire (-1) - netmap_daq_acquire: Encountered error condition on a packet socket
-- [1] igb0:igb1
Can't acquire (-1) - netmap_daq_acquire: Encountered error condition on a packet socket
-- [2] igb0:igb1
Can't acquire (-1) - netmap_daq_acquire: Encountered error condition on a packet socket
-- [0] igb0:igb1

Snort3 still runs but top only reports it's using 2 threads, the same as if you don't specify -z.

Thank you,

Aaron

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20171130/20c1a746/attachment.html>


More information about the Snort-users mailing list