Suricata cant capture Loopback Interface

Error when capture loopback interface, how to fix, thanks!!!

Look like suricata cant capture loopback interface via cmdline, i triend another VM is same result!

Try: sudo suricata --pcap=lo.

I think there is an issue with the af-packet defaults, but don’t remember the details. So you may also have some success with playing with the af-packet yaml settings.

1 Like