# ERROR: Pcap file does not exist

**URL:** <https://forum.suricata.io/t/error-pcap-file-does-not-exist/1797>\
**Category:** Help\
**Created:** [October 9, 2021, 3:55pm UTC](https://forum.suricata.io/t/error-pcap-file-does-not-exist/1797 "2021-10-09T15:55:44Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![halimzhz](https://avatars.discourse-cdn.com/v4/letter/h/bc79bd/32.png) [@halimzhz](https://forum.suricata.io/u/halimzhz)\
**Post date:** [October 9, 2021, 3:55pm UTC](https://forum.suricata.io/t/error-pcap-file-does-not-exist/1797/1 "2021-10-09T15:55:45Z")

</div>

Hi,

Today after i restart my server and run as usual command:

/usr/local/bin/trafr -s | /usr/sbin/suricata -c /etc/suricata/suricata.yaml -r -&

I found my suricata 4.1.10 cannot start, i try to search around and try with:

/usr/local/bin/trafr -s | /usr/sbin/suricata -c /etc/suricata/suricata.yaml --runmode autofp -v -r /dev/stdin

Its running but its suddently stop, the log is:  
9/10/2021 – 23:40:10 - - This is Suricata version 4.1.10 RELEASE  
9/10/2021 – 23:40:10 - - CPUs/cores online: 4  
9/10/2021 – 23:40:10 - - [ERRCODE: SC\_WARN\_DEFAULT\_WILL\_CHANGE(317)] - in 5.0 the default for decoder event stats will go from ‘decoder..’ to ‘decoder.event..’. See ticket #2225. To suppress this message, set stats.decoder-events-prefix in the yaml.  
9/10/2021 – 23:40:10 - - fast output device (regular) initialized: fast.log  
9/10/2021 – 23:40:10 - - Using log dir /var/log/suricata/  
9/10/2021 – 23:40:10 - - Selected pcap-log compression method: none  
9/10/2021 – 23:40:10 - - using normal logging  
9/10/2021 – 23:40:10 - - stats output device (regular) initialized: stats.log  
9/10/2021 – 23:40:16 - - 55 rule files processed. 37041 rules successfully loaded, 0 rules failed  
9/10/2021 – 23:40:16 - - Threshold config parsed: 0 rule(s) found  
9/10/2021 – 23:40:18 - - 37044 signatures processed. 634 are IP-only rules, 3961 are inspecting packet payload, 33645 inspect application layer, 0 are decoder event only  
9/10/2021 – 23:40:57 - - Checking file or directory /dev/stdin  
9/10/2021 – 23:40:57 - - Argument /dev/stdin was a directory  
9/10/2021 – 23:40:57 - - Initializing PCAP ring buffer for /var/log/suricata//log.pcap.  
9/10/2021 – 23:40:57 - - Ring buffer initialized with 0 files.  
9/10/2021 – 23:40:57 - - all 5 packet processing threads, 4 management threads initialized, engine started.  
9/10/2021 – 23:40:57 - - Starting directory run for /dev/stdin  
9/10/2021 – 23:40:57 - - Processing pcaps directory /dev/stdin, files must be newer than 0 and older than 18446744073709550616  
9/10/2021 – 23:40:57 - - Directory run mode complete  
9/10/2021 – 23:40:57 - - Signal Received. Stopping engine.  
9/10/2021 – 23:40:57 - - time elapsed 0.135s  
9/10/2021 – 23:40:57 - - Pcap-file module read 0 files, 0 packets, 0 bytes  
9/10/2021 – 23:40:57 - - Alerts: 0  
9/10/2021 – 23:40:58 - - cleaning up signature grouping structure… complete

Please help. What should i do ?

---

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\
**Post date:** [October 10, 2021, 12:45pm UTC](https://forum.suricata.io/t/error-pcap-file-does-not-exist/1797/2 "2021-10-10T12:45:25Z")

</div>

Hi and welcome to the community!

Suricata stopped because of a signal as indicated by the following message

> [@halimzhz](#):
>
> 9/10/2021 – 23:40:57 - - Signal Received. Stopping engine.

I encourage you to update your Suricata deployment to a version such as 5.0.7 or 6.0.3 before we spend too much time trying to determine what might be happening.

The version you’re using has been end-of-lifed (and is no longer supported)

---

<div class="post-metadata">

**Author:** ![halimzhz](https://avatars.discourse-cdn.com/v4/letter/h/bc79bd/32.png) [@halimzhz](https://forum.suricata.io/u/halimzhz)\
**Post date:** [October 10, 2021, 6:30pm UTC](https://forum.suricata.io/t/error-pcap-file-does-not-exist/1797/3 "2021-10-10T18:30:26Z")

</div>

Hi Jeff,

Is there any issue too all my current rules if i upgrade to version 5 ? May i know how can i upgrade and if not mistaken i’m doing manual installation, is there any step i should follow ?

Please advice and thank you so much

---

<div class="post-metadata">

**Author:** ![halimzhz](https://avatars.discourse-cdn.com/v4/letter/h/bc79bd/32.png) [@halimzhz](https://forum.suricata.io/u/halimzhz)\
**Post date:** [October 10, 2021, 9:48pm UTC](https://forum.suricata.io/t/error-pcap-file-does-not-exist/1797/4 "2021-10-10T21:48:21Z")

</div>

Dear All,

I just upgrade to the latest suricata 6, but i still facing a same problem when i run command:

/usr/local/bin/trafr -s | /usr/sbin/suricata -c /etc/suricata/suricata.yaml --runmode autofp -v -r /dev/stdin  
11/10/2021 – 05:39:17 - - This is Suricata version 6.0.3 RELEASE running in USER mode  
11/10/2021 – 05:39:17 - - CPUs/cores online: 4  
11/10/2021 – 05:39:17 - - fast output device (regular) initialized: fast.log  
11/10/2021 – 05:39:17 - - Using log dir .  
11/10/2021 – 05:39:17 - - Selected pcap-log compression method: none  
11/10/2021 – 05:39:17 - - using normal logging  
11/10/2021 – 05:39:17 - - stats output device (regular) initialized: stats.log  
11/10/2021 – 05:39:22 - - 55 rule files processed. 37020 rules successfully loaded, 0 rules failed  
11/10/2021 – 05:39:22 - - Threshold config parsed: 0 rule(s) found  
11/10/2021 – 05:39:24 - - 37023 signatures processed. 613 are IP-only rules, 3960 are inspecting packet payload, 32443 inspect application layer, 0 are decoder event only  
11/10/2021 – 05:40:51 - - Argument /dev/stdin was a directory  
11/10/2021 – 05:40:51 - - Initializing PCAP ring buffer for ./log.pcap.  
11/10/2021 – 05:40:51 - - Ring buffer initialized with 0 files.  
11/10/2021 – 05:40:52 - - all 5 packet processing threads, 4 management threads initialized, engine started.  
11/10/2021 – 05:40:52 - - Starting directory run for /dev/stdin  
11/10/2021 – 05:40:52 - - Processing pcaps directory /dev/stdin, files must be newer than 0 and older than 18446744073709550616  
11/10/2021 – 05:40:52 - - Directory run mode complete  
11/10/2021 – 05:40:52 - - Signal Received. Stopping engine.  
11/10/2021 – 05:40:52 - - time elapsed 0.731s  
11/10/2021 – 05:40:52 - - Pcap-file module read 0 files, 0 packets, 0 bytes  
11/10/2021 – 05:40:52 - - Alerts: 0  
11/10/2021 – 05:40:53 - - cleaning up signature grouping structure… complete

I also modify suricata.yaml without load any rules, but its still the samething

Please help me. Thank you

---

<div class="post-metadata">

**Author:** ![halimzhz](https://avatars.discourse-cdn.com/v4/letter/h/bc79bd/32.png) [@halimzhz](https://forum.suricata.io/u/halimzhz)\
**Post date:** [October 11, 2021, 11:16am UTC](https://forum.suricata.io/t/error-pcap-file-does-not-exist/1797/5 "2021-10-11T11:16:37Z")

</div>

Hi,

I just try running with different way withour ‘r’:

/usr/local/bin/trafr -s | /usr/sbin/suricata -c /etc/suricata/suricata.yaml --runmode autofp -v -i enp2s4  
11/10/2021 – 19:10:59 - - Including configuration file rules.yaml.  
11/10/2021 – 19:10:59 - - This is Suricata version 6.0.3 RELEASE running in SYSTEM mode  
11/10/2021 – 19:10:59 - - CPUs/cores online: 4  
11/10/2021 – 19:10:59 - - Found an MTU of 1500 for ‘enp2s4’  
11/10/2021 – 19:10:59 - - Found an MTU of 1500 for ‘enp2s4’  
11/10/2021 – 19:10:59 - - fast output device (regular) initialized: fast.log  
11/10/2021 – 19:10:59 - - Using log dir /var/log/suricata/  
11/10/2021 – 19:10:59 - - Selected pcap-log compression method: none  
11/10/2021 – 19:10:59 - - using normal logging  
11/10/2021 – 19:10:59 - - stats output device (regular) initialized: stats.log  
11/10/2021 – 19:10:59 - - Running in live mode, activating unix socket  
11/10/2021 – 19:11:06 - - 55 rule files processed. 37021 rules successfully loaded, 0 rules failed  
11/10/2021 – 19:11:06 - - Threshold config parsed: 0 rule(s) found  
11/10/2021 – 19:11:10 - - 37024 signatures processed. 614 are IP-only rules, 3960 are inspecting packet payload, 32443 inspect application layer, 0 are decoder event only  
11/10/2021 – 19:12:29 - - Going to use 4 ReceiveAFP receive thread(s)  
11/10/2021 – 19:12:29 - - Initializing PCAP ring buffer for /var/log/suricata//log.pcap.  
11/10/2021 – 19:12:29 - - Ring buffer initialized with 1 files.  
11/10/2021 – 19:12:29 - - Running in live mode, activating unix socket  
11/10/2021 – 19:12:29 - - Using unix socket file ‘/var/run/suricata/suricata-command.socket’  
11/10/2021 – 19:12:29 - - all 8 packet processing threads, 4 management threads initialized, engine started.  
11/10/2021 – 19:12:29 - - All AFP capture threads are running.

And no more ‘Signal Received. Stopping engine.’ But why it cant run with usual with ‘r’ ?

Please help. TQ

---

<div class="post-metadata">

**Author:** ![halimzhz](https://avatars.discourse-cdn.com/v4/letter/h/bc79bd/32.png) [@halimzhz](https://forum.suricata.io/u/halimzhz)\
**Post date:** [October 11, 2021, 11:19am UTC](https://forum.suricata.io/t/error-pcap-file-does-not-exist/1797/6 "2021-10-11T11:19:56Z")

</div>

If with ‘r’:

/usr/local/bin/trafr -s | /usr/sbin/suricata -c /etc/suricata/suricata.yaml --runmode autofp -v -r -&  
root@netmon [~]# 11/10/2021 – 19:18:42 - - [ERRCODE: SC\_ERR\_INITIALIZATION(45)] - ERROR: Pcap file does not exist

Please help me.

---

<div class="post-metadata">

**Author:** ![halimzhz](https://avatars.discourse-cdn.com/v4/letter/h/bc79bd/32.png) [@halimzhz](https://forum.suricata.io/u/halimzhz)\
**Post date:** [October 11, 2021, 11:21am UTC](https://forum.suricata.io/t/error-pcap-file-does-not-exist/1797/7 "2021-10-11T11:21:50Z")

</div>

Below is my build info

This is Suricata version 6.0.3 RELEASE  
Features: NFQ PCAP\_SET\_BUFF PF\_RING AF\_PACKET HAVE\_PACKET\_FANOUT LIBCAP\_NG LIBNET1.1 HAVE\_HTP\_URI\_NORMALIZE\_HOOK PCRE\_JIT HAVE\_NSS HAVE\_LUA HAVE\_LIBJANSSON TLS TLS\_GNU MAGIC RUST  
SIMD support: SSE\_3  
Atomic intrinsics: 1 2 4 8 16 byte(s)  
64-bits, Little-endian architecture  
GCC version 4.8.5 20150623 (Red Hat 4.8.5-44), C version 199901  
compiled with -fstack-protector  
compiled with \_FORTIFY\_SOURCE=2  
L1 cache line size (CLS)=64  
thread local storage method: \_\_thread  
compiled with LibHTP v0.5.38, linked against LibHTP v0.5.36

Suricata Configuration:  
AF\_PACKET support: yes  
eBPF support: no  
XDP support: no  
PF\_RING support: yes  
NFQueue support: yes  
NFLOG support: no  
IPFW support: no  
Netmap support: no  
DAG enabled: no  
Napatech enabled: no  
WinDivert enabled: no

Unix socket enabled: yes  
Detection enabled: yes

Libmagic support: yes  
libnss support: yes  
libnspr support: yes  
libjansson support: yes  
hiredis support: yes  
hiredis async with libevent: no  
Prelude support: no  
PCRE jit: yes  
LUA support: yes  
libluajit: no  
GeoIP2 support: yes  
Non-bundled htp: no  
Hyperscan support: no  
Libnet support: yes  
liblz4 support: yes  
HTTP2 decompression: no

Rust support: yes  
Rust strict mode: no  
Rust compiler path: /bin/rustc  
Rust compiler version: rustc 1.55.0 (Red Hat 1.55.0-1.el7)  
Cargo path: /bin/cargo  
Cargo version: cargo 1.55.0  
Cargo vendor: yes

Python support: yes  
Python path: /usr/local/bin/python3  
Python distutils yes  
Python yaml yes  
Install suricatactl: yes  
Install suricatasc: yes  
Install suricata-update: yes

Profiling enabled: no  
Profiling locks enabled: no

Plugin support (experimental): yes

Development settings:  
Coccinelle / spatch: no  
Unit tests enabled: no  
Debug output enabled: no  
Debug validation enabled: no

Generic build parameters:  
Installation prefix: /usr  
Configuration directory: /etc/suricata/  
Log directory: /var/log/suricata/

–prefix /usr  
–sysconfdir /etc  
–localstatedir /var  
–datarootdir /usr/share

Host: x86\_64-pc-linux-gnu  
Compiler: gcc (exec name) / g++ (real)  
GCC Protect enabled: yes  
GCC march native enabled: yes  
GCC Profile enabled: no  
Position Independent Executable enabled: no  
CFLAGS -g -O2 -std=gnu99 -march=native -I${srcdir}/…/rust/gen -I${srcdir}/…/rust/dist  
PCAP\_CFLAGS -I/usr/local/include  
SECCFLAGS -fstack-protector -D\_FORTIFY\_SOURCE=2 -Wformat -Wformat-security

Please help.

---

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\
**Post date:** [October 11, 2021, 12:07pm UTC](https://forum.suricata.io/t/error-pcap-file-does-not-exist/1797/8 "2021-10-11T12:07:38Z")

</div>

Hi,

Suricata is terminating execution because it received “end of file” from `/dev/stdin`.

Try the following (corrected) commandline:

```auto
/usr/local/bin/trafr -s | /usr/sbin/suricata -c /etc/suricata/suricata.yaml --runmode=autofp -v -r /dev/stdin

```

To confirm, do you see lines similar to these in the output?

```auto
[1822239] 11/10/2021 -- 08:03:39 - (source-pcap-file-helper.c:156) <Info> (PcapFileDispatch) -- pcap file /dev/stdin end of file reached (pcap err code 0)
[1822225] 11/10/2021 -- 08:03:39 - (suricata.c:2630) <Notice> (SuricataMainLoop) -- Signal Received. Stopping engine.

```

---

<div class="post-metadata">

**Author:** ![halimzhz](https://avatars.discourse-cdn.com/v4/letter/h/bc79bd/32.png) [@halimzhz](https://forum.suricata.io/u/halimzhz)\
**Post date:** [October 11, 2021, 1:16pm UTC](https://forum.suricata.io/t/error-pcap-file-does-not-exist/1797/9 "2021-10-11T13:16:13Z")

</div>

Hi,

I try to execute that and the result:

/usr/local/bin/trafr -s | /usr/sbin/suricata -c /etc/suricata/suricata.yaml --runmode=autofp -v -r /dev/stdin  
11/10/2021 – 21:11:16 - - Including configuration file rules.yaml.  
11/10/2021 – 21:11:16 - - This is Suricata version 6.0.3 RELEASE running in USER mode  
11/10/2021 – 21:11:16 - - CPUs/cores online: 4  
11/10/2021 – 21:11:16 - - fast output device (regular) initialized: fast.log  
11/10/2021 – 21:11:16 - - Using log dir .  
11/10/2021 – 21:11:16 - - Selected pcap-log compression method: none  
11/10/2021 – 21:11:16 - - using normal logging  
11/10/2021 – 21:11:16 - - stats output device (regular) initialized: stats.log  
11/10/2021 – 21:11:21 - - 55 rule files processed. 37024 rules successfully loaded, 0 rules failed  
11/10/2021 – 21:11:22 - - Threshold config parsed: 0 rule(s) found  
11/10/2021 – 21:11:24 - - 37027 signatures processed. 617 are IP-only rules, 3960 are inspecting packet payload, 32443 inspect application layer, 0 are decoder event only  
11/10/2021 – 21:12:41 - - Argument /dev/stdin was a directory  
11/10/2021 – 21:12:41 - - Initializing PCAP ring buffer for ./log.pcap.  
11/10/2021 – 21:12:41 - - Ring buffer initialized with 2 files.  
11/10/2021 – 21:12:41 - - all 5 packet processing threads, 4 management threads initialized, engine started.  
11/10/2021 – 21:12:41 - - Starting directory run for /dev/stdin  
11/10/2021 – 21:12:41 - - Processing pcaps directory /dev/stdin, files must be newer than 0 and older than 18446744073709550616  
11/10/2021 – 21:12:41 - - Directory run mode complete  
11/10/2021 – 21:12:41 - - Signal Received. Stopping engine.  
11/10/2021 – 21:12:41 - - time elapsed 0.153s  
11/10/2021 – 21:12:41 - - Pcap-file module read 0 files, 0 packets, 0 bytes  
11/10/2021 – 21:12:41 - - Alerts: 0  
11/10/2021 – 21:12:42 - - cleaning up signature grouping structure… complete

Please help

---

<div class="post-metadata">

**Author:** ![halimzhz](https://avatars.discourse-cdn.com/v4/letter/h/bc79bd/32.png) [@halimzhz](https://forum.suricata.io/u/halimzhz)\
**Post date:** [October 11, 2021, 1:23pm UTC](https://forum.suricata.io/t/error-pcap-file-does-not-exist/1797/10 "2021-10-11T13:23:07Z")

</div>

Hi,

I realize its start happen after i reboot the server and before that i did run ‘yum update -y’, i didnt reboot and running yum update almost 2 years, you think the latest update of pcap is the cause ? My server is Centos 7

Please Help. TQ

---

<div class="post-metadata">

**Author:** ![halimzhz](https://avatars.discourse-cdn.com/v4/letter/h/bc79bd/32.png) [@halimzhz](https://forum.suricata.io/u/halimzhz)\
**Post date:** [October 12, 2021, 11:39pm UTC](https://forum.suricata.io/t/error-pcap-file-does-not-exist/1797/11 "2021-10-12T23:39:30Z")

</div>

Anyone ? Please help.

---

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\
**Post date:** [October 13, 2021, 11:59am UTC](https://forum.suricata.io/t/error-pcap-file-does-not-exist/1797/12 "2021-10-13T11:59:36Z")

</div>

Can you validate the output of `trafr`? My understanding of the issue is that EOF is being returned to Suricata when reading from the input stream provided by `trafr`

---

<div class="post-metadata">

**Author:** ![halimzhz](https://avatars.discourse-cdn.com/v4/letter/h/bc79bd/32.png) [@halimzhz](https://forum.suricata.io/u/halimzhz)\
**Post date:** [October 14, 2021, 3:27pm UTC](https://forum.suricata.io/t/error-pcap-file-does-not-exist/1797/13 "2021-10-14T15:27:05Z")

</div>

Hi,

Can you tell me how to validate ? TQ

---

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\
**Post date:** [October 15, 2021, 12:06pm UTC](https://forum.suricata.io/t/error-pcap-file-does-not-exist/1797/14 "2021-10-15T12:06:20Z")

</div>

`suricata` is receiving EOF from `/dev/stdin` … that stream is expected to contain pcap data as supplied by `trafr`.

I’m not familiar with `trafr` but it should be sending data formatted as pcap for you.

As a temporary test – try `cat /path/to/file.pcap` instead of `trafr`