Feb 7, 2019, 2:37:19 PM2/7/19
I searched on here to see if this was posted yet and did not find it, so I thought I'd add this nugget in the event someone else has the same problem.
I loaded SO on a laptop with a bunch of USB NICs, because there was no onboard NIC. Everything worked well except for Suricata and Snort, both of which showed the service had failed with a stale PID when I ran so-status. Looking into the logs for each, pf_ring was failing to load. Folks in this forum recommended swapping out the USB NIC for a hardwired one, but that wasn't an option for me, given the hardware.
Turns out that the issue is with how pf_ring deals with the interface names. The default behavior in 16.04 is for Ubuntu to append your MAC to the USB ethernet device so it becomes rather long. This makes it too long to parse thanks to struct sockaddr.sa_data which is used by bind(). The recommendation in the thread I found was to shorten the interface name.
Thus, I updated /etc/udev/rules.d/70-persistent-net.rules to force the names to eth101 and eth102, rebooted, executed setup with the new names and voila! Snort and Suricata are both happy, because pf_ring is happy.
Hope this helps.