If you run a local copy of the packages repo, you can sync it to any version/commit you want.

If someday pfSense packages files get fetched by a commit id or tag just like we can do on freebsd ports, it will be easy to roll back.

@simby:

Do we have snort 3.0 date in pfsense ?  8)

No.  Two external events have to occur first.  Those are (in order of occurrence):

1.  Snort 3.0 goes to RELEASE state

2.  The FreeBSD port of Snort updates to the 3.0 code base.

Until both of the events above transpire, the Snort package will stay on the 2.9.x code base.

Bill

bump

The stream alerts can be very annoying, especially on an installation using libpcap like the package utilizes on pfSense.  I generally disable the majority of those stream alert rules in Suricata.

Bill

Some questions for you to help with troubleshooting:

1.  Did you ever run Snort before?  In other words, could there be an old Snort configuration that the package install is seeing and using?

2.  Are you running a full install of pfSense on a HDD or SSD, or is this a NanoBSD installation on a CF card?

3.  Do you see any messages in the system log related to the Snort package?

Some notes –

If you once had Snort installed and the setting enabled to save the configuration, then the new install will detect and try to use those old settings.  If that old configuration used a ton of rules, it can take many seconds (up to 1 minute or more) for Snort to start.  If you leave the package installation screen before that process completes, the final piece of package installation will not happen and you will not see a Snort menu selection under SERVICES.

Bill

@Roger:

Hi

Yes, I get re0 and re1 listed after a 'Full Scan', did you do a 'Full Scan' in check_mk ?

My server version is the latest 1.2.4 version.

Roger

Perfect Roger, i only have to do a full scan.

Thanks!

Thank you Marcelloc! I'll play around with it :)

Don't stay fixated on just your file MD5 hash table needs.  A lot of other Suricata stuff uses the hash table as well.  The error message was indicating a computed hash table requirement of 40,674,836,480 bytes.  I have no idea is that number is accurate or not, but I can tell it is being computed by the binary part of Suricata and not the PHP GUI part.

Bill

@ghkrauss:

Gentlemen:

I have Suricata installed running with Pfsense 2.2. I have a subscription to Emering Threats ETPro rules. Does one have to also install Snort rules also? Any specific configuration issues for Emerging Threats ETPro rules?

No, there is no requirement to use the Snort VRT rules.  In fact, you will find that a significant number of them (around 700 or more at last count) will not compile and run on Suricata due to them containing some rule options and keywords that are not currently supported in Suricata.  If you have an ET-Pro subscription, you should be fine.

There some configuration threads posted here in the Packages forum.  Do a quick search for "Suricata blueprint" and that should turn up one of them.

Bill

I have also found that my networks work better when I'm not the one trying to cripple them (-:

@Nachtfalke:

Question 1:

Is it possible to get a separte report which shows me the websites the user(s) connected between specific hours. So I want a report which only shows the reports between 0900-0959 and between 1000-1059. With the SARG arguments above and disabled "overwrite reports" I got an hourly report but this report contains everything from the beginning of the say. So like 0000-0859 and the next report from 0000-0959. So I would appreciate any suggestions or corrections if I did configure or understand something wrong.

Will work only if you rotate the log without "overwrite reports" checked.

Question 2:
I am not able to find a statistic where I can exactly see which user(s) accessed which website at a specific timerange. So I want to see that one user accessed www.google.com at 091:10am, 0935am and so on. The reason why I am interested in this statistic is because I want to know why a snort alert was generated. I want to see which websites were accessed at this time by a specific user to find out if it was the website the user accessed generated the alert or if it was some "adware banner" or something crosslinked on the page which generated the alert.

'sites and users' reports show who accessed the site but it does not include a time colum. but if you click on the user, sarg will redirect you to client day report.

Tunables recommended for FreeBSD in a server role often do not make sense for pfSense in a firewall role. The nature of connections and traffic are completely different.

Tunables shouldn't be added or changed unless the implications are properly understood for all of them. There isn't a "one size fits all" list of tunables to be applied. We set things by default that are good to have, and others may be tweaked but unless there is a reason for doing so, don't apply values that are "recommended" for other configurations.

That said, the error you see would likely also happen to Unbound on FreeBSD in the same configuration.

Squid is the only package I have installed, a box that will do DHCP, firewall and DNS & web caching is what I was after when I built this.

By moving the cache out of /var, squid is finally caching (into a persistent cache). I have had this running for like a week now caching updates for different machines, I got it rebooted few times and the cache is ~4GB and keeps growing  :)

hi wcrowder!

I really appreciate your offer to assist. I am overseas (In Medellin, Colombia, actually), and will be back home on March 5th. BBCan, as awesome as he is, also offered to help (you guys rock! thank you!).

If you can, It'd be awesome to have a TeamViewer or WebEx session on or after march 5th. If you are unable to, I'll gather logs and shoot 'em over your way. I'm sure it's not working due to something stupid I did :P

Again, thank you and have a great weekend, sir!

l.facebook.com/l.php?u=http%3A%2F%2Fwww.tribunnews.com%2F&h=HAQEwpIza&enc=AZMlvzs5zE2Ko8ne2PruhtgOlOkfZtT1B76qEM1CgSTXb4SJYbTvTu7U0eyynBc7wxKnLKyDGVNS6ttdnRqr13qkFCXbnp8wL4Liu8LeiEYJVAGlerGeDVId413J9fZckrzHJOj8q1z-i7mxnXXWmxtwhu9_3b-atDWZwWEa9zHBSA&s=1

The filter Thinks you're trying to download a file with .com extension (Microsoft Command file - like EXE)

The filter matches anything that is after the / and contains a dot (.) and then the list of those 3-letter extensions. Note that the // in http:// is not matched because http:// is not considered in the filter.
The / in the regexp prevent it from matching a .com domain when accessing it directly - like www.domain.com.
So the filter blocks: www.example.org/index.php?redirect=http://www.site2.com
but not
www.site2.com

(./..(asf|wm|3gp|ogg|aac|apk|big|bik|exe|com|bat|ogv|flp|cam|fla|mkv|mov|mp4|rm|yuv|wma|wmv|cab|mp3|avi|mpg|swf|mpeg|mp.|mpv|wm.|vpu))

Thanks for your help. Now installed successfully! ;D

Thanks for the tip.  I'm running Squid non -transparently, if that makes any difference.

They are on youtube the whole day and listen to the same song over and over again and they share youtube links

Gah, sounds like Hell!  :o