Network is down

wangmumu · July 19, 2021, 2:59am

Hi,I am very very new here and I need some help.Thanks everyone if someone can give me one hand.
After something I done,there is an error in /var/log/suricata/suricata.log.
The error log says: Error reading data from iface ‘eno2’:Network is down.
I checked the network,but it is up.So I don’t know how to fix it.
Thanks again.

wangmumu · July 19, 2021, 3:19am

By the way, I use the SELKS.iso to install on my device.

Andreas_Herz · July 27, 2021, 3:37pm

Can you give us more details about your setup and configuration?
Can you check the syslog and dmesg for the same timeframe if there was any change on the NIC eno2?

wangmumu · August 5, 2021, 2:00am

It works now.But when I choose three interfaces as sniff interfaces, the log file sites /var/log/suricata/suricata.log and it says: failed to setup/expand stream session pool. Expand stream memcap?
How can I expand stream memcap?
I checked selks6-interfaces-config.yaml and these three interfaces have different cluster_id 。

wangmumu · August 5, 2021, 2:01am

I didn’t change the default setup and configurations.
By the way, I don’t know how to check syslog and dmesg.

syoc · August 6, 2021, 7:00am

github.com

OISF/suricata/blob/master/suricata.yaml.in#L1314

    
      
          #
          #     check-overlap-different-data: true|false
          #                               # check if a segment contains different data
          #                               # than what we've already seen for that
          #                               # position in the stream.
          #                               # This is enabled automatically if inline mode
          #                               # is used or when stream-event:reassembly_overlap_different_data;
          #                               # is used in a rule.
          #
          stream:
            memcap: 64mb
            checksum-validation: yes      # reject incorrect csums
            inline: auto                  # auto will use inline mode in IPS mode, yes or no set it statically
            reassembly:
              memcap: 256mb
              depth: 1mb                  # reassemble 1mb into a stream
              toserver-chunk-size: 2560
              toclient-chunk-size: 2560
              randomize-chunk-size: yes
              #randomize-chunk-range: 10
              #raw: yes

That line changes the stream memcap. If you get this error with three interfaces and not with one it might be related to per-interface allocations.

Topic		Replies	Views
Suricata interface keeps going down Help	8	313	September 6, 2023
Suspected memleak in Suricata 6.0.3 Help	5	942	April 7, 2022
Generic Protocol Command Decode Help	13	12573	March 13, 2021
ERRCODE: SC_ERR_PCAP_TRANSLATE(201) failed to find a pcap device for IP 192.2.5.8 Help	1	430	September 28, 2021
After entering this text ( sudo tail /var/log/suricata/suricata.log), an error appeared, how to fix it	23	446	December 12, 2023

Network is down

Related Topics