# E :af-packet: fanout not supported by kernel: Kernel too old or cluster-id 99 already in use

**URL:** <https://forum.suricata.io/t/e-fanout-not-supported-by-kernel-kernel-too-old-or-cluster-id-99-already-in-use/4789>\
**Category:** Help\
**Tags:** suricata\
**Created:** [July 31, 2024, 8:56am UTC](https://forum.suricata.io/t/e-fanout-not-supported-by-kernel-kernel-too-old-or-cluster-id-99-already-in-use/4789 "2024-07-31T08:56:27Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![deneme\_yanilma](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/deneme_yanilma/32/3037_2.png) [@deneme\_yanilma](https://forum.suricata.io/u/deneme_yanilma)\
**Post date:** [July 31, 2024, 8:56am UTC](https://forum.suricata.io/t/e-fanout-not-supported-by-kernel-kernel-too-old-or-cluster-id-99-already-in-use/4789/1 "2024-07-31T08:56:27Z")

</div>

> - Suricata version : This is Suricata version 7.0.3 RELEASE
> - Ubuntu 24.04 LTS
> - How you installed Suricata : i nstalled it with these commands  
> sudo apt-get install software-properties-common  
> sudo add-apt-repository ppa:oisf/suricata-stable  
> sudo apt update  
> sudo apt install suricata jq

i am getting this error while configuration if it will be needed i can share my suricate.yaml file

Thank you for your time.

---

<div class="post-metadata">

**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\
**Post date:** [July 31, 2024, 8:57am UTC](https://forum.suricata.io/t/e-fanout-not-supported-by-kernel-kernel-too-old-or-cluster-id-99-already-in-use/4789/2 "2024-07-31T08:57:50Z")

</div>

Share your `suricata.yaml` an dalso the `suricata.log` and also the run command.

---

<div class="post-metadata">

**Author:** ![deneme\_yanilma](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/deneme_yanilma/32/3037_2.png) [@deneme\_yanilma](https://forum.suricata.io/u/deneme_yanilma)\
**Post date:** [July 31, 2024, 9:36am UTC](https://forum.suricata.io/t/e-fanout-not-supported-by-kernel-kernel-too-old-or-cluster-id-99-already-in-use/4789/3 "2024-07-31T09:36:31Z")

</div>

Command that is used sudo suricata -c /etc/suricata/suricata.yaml -i ens18

i have copied .log and .yaml to txt

---

<div class="post-metadata">

**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\
**Post date:** [July 31, 2024, 10:15am UTC](https://forum.suricata.io/t/e-fanout-not-supported-by-kernel-kernel-too-old-or-cluster-id-99-already-in-use/4789/4 "2024-07-31T10:15:51Z")

</div>

What type of CPU is this?  
What kernel version?  
Did you ensure that there is no other process running that uses the same cluster-id? Maybe even a second Suricata instance running?  
Otherwise try other numbers for the cluster-id

---

<div class="post-metadata">

**Author:** ![deneme\_yanilma](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/deneme_yanilma/32/3037_2.png) [@deneme\_yanilma](https://forum.suricata.io/u/deneme_yanilma)\
**Post date:** [July 31, 2024, 10:30am UTC](https://forum.suricata.io/t/e-fanout-not-supported-by-kernel-kernel-too-old-or-cluster-id-99-already-in-use/4789/5 "2024-07-31T10:30:42Z")

</div>

Sorry for taking your time somehow i manage to fix it with ai . i purged it , reinstalled and  
reconfigured it.