Snort 3 ipfw Multithreading Errors
cArleone last edited by
I use snort3 run option with multithreading and daq module ipfw and port 5000 but I cant start snort3
I was see error this
ipfw DAQ configured to passive. Commencing packet processing ++  ++  ++  Can't start DAQ (-1) - ipfw_daq_start: can't bind divert socket (Address already in use) Analyzer: Failed to start DAQ instance Can't start DAQ (-1) - ipfw_daq_start: can't bind divert socket (Address already in use) Analyzer: Failed to start DAQ instance --  -- 
Can you help with this error ?
Freebsd Versions :
FreeBSD snort 11.2-RELEASE-p4
Snort Versions :
,,_ -*> Snort++ <*- o" )~ Version 3.0.0 (Build 247) FreeBSD '''' By Martin Roesch & The Snort Team http://snort.org/contact#team Copyright (C) 2014-2018 Cisco and/or its affiliates. All rights reserved. Copyright (C) 1998-2013 Sourcefire, Inc., et al. Using DAQ version 2.2.2 Using LuaJIT version 2.0.5 Using OpenSSL 1.0.2p 14 Aug 2018 Using libpcap version 1.9.0-PRE-GIT Using PCRE version 8.41 2017-07-05 Using ZLIB version 1.2.11 Using FlatBuffers 1.8.0 Using Hyperscan version 4.7.0 2018-10-03 Using LZMA version 5.2.3
Run Command :
/usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua --daq ipfw --daq-var port=5000 -l /var/log/snort -k none -A alert_full --max-packet-threads 3
bmeeks last edited by bmeeks
This is a bug within Snort3 itself. There was a thread about it posted to the Snort Development mailing list today. The Snort developers acknowledged the bug.
By the way, Snort3 is not yet supported on pfSense. It may work for you, but everything will have to be done via the command line as the GUI package does not support Snort3.
bmeeks last edited by
Here is an additional comment on Snort3 multithreading with ipfw. I copied this from the Snort Developer mailing list. The author is one of the Snort3 developers --
"I need to correct myself. There is a way to configure DAQ for multiple threads. Please refer to snort3 documentation section – DAQ Configuration and Modules. You will need to configure a separate port for each thread. Also, please note that snort3 doesn’t yet support load balancing internally."