pulledpork icon indicating copy to clipboard operation
pulledpork copied to clipboard

Issuing reputation socket reload command - (Error) ?

Open usernameSecret opened this issue 2 years ago • 0 comments

I did configure a cron job for downloading the latest rules.

On the ip-block-list I get an Error.

"can't set DAQ BPF filter to '/etc/snort/rules/iplists 1361' (pcap_daq_set_filter: pcap_compile: can't parse filter expression: syntax error! Fatal error, Quitting.."

Seems the app tries set the daq filter on the "IPRVersion.dat" file, and I don't know if all is downloaded and configured well, after this error.

I did check the daq setting in snort. I use snort as IDS. Default seems to be "daq-pcap-passive" as it seems I can't change much there.

  • OS is Debian-11 as virtual machine
  • snort 2.9.15.1 GRE (Build 15125) (installed with apt-get) , libpcap 1.10.0 (TPACKET_V3) , PCRE 8.39 2016-06-14, ZLIB 1.2.11
  • pulledpork v0.7.4

How could the error be solved ?

Thank you

usernameSecret avatar Aug 02 '22 05:08 usernameSecret