Home page logo

snort logo Snort mailing list archives

Snort 2.9, RHEL 5 and afpacket DAQ
From: Ralf Spenneberg <ralf () spenneberg de>
Date: Mon, 18 Oct 2010 20:28:22 +0200


I am playing around with Snort 2.9.0 on RHEL 5. Using the DAQ libraries
with libpcap works fine. But the afpacket daq module always bails on

# snort --daq afpacket
Running in packet dump mode

        --== Initializing Snort ==--
Initializing Output Plugins!
afpacket DAQ configured to passive.
Acquiring network traffic from "eth0".

        --== Initialization Complete ==--

   ,,_     -*> Snort! <*-
  o"  )~   Version 2.9.0 (Build 68) 
   ''''    By Martin Roesch & The Snort Team:
           Copyright (C) 1998-2010 Sourcefire, Inc., et al.
           Using libpcap version 1.1.1
           Using PCRE version: 6.6 06-Feb-2006

Commencing packet processing (pid=3329)
Decoding Ethernet
ERROR: Can't start DAQ (-1) - create_rx_ring: Couldn't create kernel RX
ring on packet socket: Cannot allocate memory!
Fatal Error, Quitting..

It works fine on Fedora 13. I have searched the mailing lists but have
not found any clue. Does the kernel on RHEL 5 (2.6.18) not provide the
necessary interface?

It would be fine if stated in the README or FAQ but I have not found

Any hints, clues, advices?

Kind regards,


Download new Adobe(R) Flash(R) Builder(TM) 4
The new Adobe(R) Flex(R) 4 and Flash(R) Builder(TM) 4 (formerly 
Flex(R) Builder(TM)) enable the development of rich applications that run
across multiple browsers and platforms. Download your free trials today!
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]