• Snort Throughput Calculator

    2
    0 Votes
    2 Posts
    624 Views
    bmeeksB

    There are too many variables to make an accurate calculation in my view. Why not simply test it? You can turn on Performance Stats on the PREPROCESSORS tab and look through those log outputs to see where Snort is spending its time.

  • snort license

    3
    0 Votes
    3 Posts
    500 Views
    O

    @NogBadTheBad sir just wanting to make sure that there's no issue

  • 0 Votes
    7 Posts
    928 Views
    X

    Yes, it's for home. Thanks a lot for the detailed explanation, I am going to switch to LAN interface.

  • Snort-3.2.9.10 Package Update Release Notes

    8
    2 Votes
    8 Posts
    1k Views
    bmeeksB

    @bokikay said in Snort-3.2.9.10 Package Update Release Notes:

    Hello sir @bmeeks yesterday I run an upgrade to the latest one 3.2.9.10 for snort. It woks fine after I reboot my box. Today when I checked status it stops all and it looks like this pic. I click the play button to start the status but still it won work. Do I need to remove the package and reinstall it again? Thank you sir 4325baac-1830-48fb-8b7e-0b3f966ba769-image.png

    Have you looked in the pfSense system log to see what error messages are being logged when you attempt a restart of the interfaces? How do you expect me to help you if you give me no information to go on? I need error log messages to troubleshoot. I can't just sense what's wrong through the ether with "spidy senses" or something ... 😀 .

  • suricata update killing WAN interface

    4
    0 Votes
    4 Posts
    448 Views
    kiokomanK

    yes, of course

  • Snort error on 2.5

    1
    0 Votes
    1 Posts
    107 Views
    No one has replied
  • Suricata Not Blocking legacy mode

    76
    0 Votes
    76 Posts
    22k Views
    everfreeE

    Still waiting, hope it will be fixed.

  • Snort: Internet Radio Streams blocked

    9
    0 Votes
    9 Posts
    940 Views
    I

    @NogBadTheBad
    It is,
    I wrote before I thought.

  • Cant Update Rules

    3
    0 Votes
    3 Posts
    518 Views
    S

    Thank you so much (again:)...)
    It was the proxy that we use, my problem though was that I white-listed the wrong interface...

  • Suricata v4.1.4_7 Package Update Release Notes (pfSense-2.4.4_3)

    10
    1 Votes
    10 Posts
    967 Views
    bmeeksB

    I did forget to mention that when you clear out the /var/log/suricata directory that will wipe out all of the Suricata log files, so if you want those for some reason copy them off before executing the command.

  • Suricata sometimes block

    10
    0 Votes
    10 Posts
    3k Views
    N

    Uptime 21 Days 16 Hours 14 Minutes 42 Seconds

    no more problems after I disabled suricata... :(

  • (SOLVED) Snort detecting INDICATOR-COMPROMISE suspicious .null DNS query

    Moved
    48
    0 Votes
    48 Posts
    14k Views
    T

    Thank you for the advice @bmeeks. I'll keep that in mind. 😀

  • 0 Votes
    6 Posts
    809 Views
    bmeeksB

    Even though the title for this Sticky Post says it is for Snort, the concepts and most of the screenshots are applicable to Suricata. There are some examples in there of using SID MGMT. Also, if you are using the Snort Subscriber Rules in your configuration, you could opt to enable an IPS Policy (IPS-Connectivity is a good starter policy).

  • could not update suricata

    6
    0 Votes
    6 Posts
    830 Views
    bmeeksB

    @albgen said in could not update suricata:

    @bmeeks what about how to check which process is using ram the most? Should i check with standard freebsd command line or any specific way from pfsense itself?

    While installing a package in the GUI you would need to use a CLI method via a direct console session or an SSH session. If you change "screens" in the GUI and access a different menu option while a package install is happening it can blow up the PHP session that was installing the package.

  • Suricata 4.1.5_1 on pfsense 2.5.0-DEVELOPMENT (amd64) can't start

    13
    0 Votes
    13 Posts
    1k Views
    W

    Thanks guys its now working.

  • 0 Votes
    9 Posts
    849 Views
    lexxaiL

    @bmeeks said in pfsense sync pf table snort2c to another firewall by scan loop, but what if use barnyard2 ?:

    standard Snort binary package from FreeBSD ports

    clear Snort it not ready solution.
    need load rules by subcribes, by other apps ...
    barnyard2 for read raw log from snort, for barnyard2 ideally need to have sql....
    for visualize alerts need other app...
    ip list etc ....

    On other office many years used pfsense as main gw with snort as you say.
    And will to say that 8G RAM not so much if enabled barnyard2 with snort and multiple interfaces on snort.

  • Suricata 4.1.5 keeps crashing on SG1100-2.4.4-RELEASE-p3

    8
    0 Votes
    8 Posts
    747 Views
    bmeeksB

    Also forgot to mention that if you have a Snort Subscriber Rules subscription (either paid or free), then you do not need to use the Snort GPLv2 rules. The rules in there are already within the Snort Subscriber rule set. So you would just be duplicating rules if you use the Snort GPLv2 Community Rules and the Snort Subscriber rules. The GPLv2 rules are just public free versions of some of the Snort Subscriber rules.

  • Snort Won't Start, Failed to load file-other.so

    11
    0 Votes
    11 Posts
    2k Views
    G

    I have created a pull request:
    https://github.com/pfsense/FreeBSD-ports/pull/702

    But since I have no idea how to test it, I guess some other person has to do that part.

  • after install snort, squidguard (shallalist) not working

    7
    0 Votes
    7 Posts
    549 Views
    bmeeksB

    Sorry, but I can't help you with Squid or SquidGuard. Never used either package on pfSense.

    Your Snort rules look OK, but you might be a little tight on memory.

  • Suricata LAN alerts scr vs dst & false positives

    2
    0 Votes
    2 Posts
    390 Views
    bmeeksB

    Installing games and game launchers, especially if from sources other than an official retail outlet, would give me pause. But then I am almost officially an "old fart" now and games don't interest me anymore ... ☺ .

    Back to your problem ---

    It's really hard to say if all of those are false positives. I will say that in general the ET Policy rule category is not terribly useful on a home network because it will generate alerts for lots of things that are perfectly normal for home networks. That ET Policy set is primarily aimed at the corporate IT world where things like Windows updates and other similar things are tightly controlled and usually distributed from in-house servers on the company network (think Microsoft's old SMS and later WSUS architecture). So these rules are designed to trigger on traffic that would indicate a user was downloading or installing some EXE file or DLL or ZIP file from the web instead of official company infrastructure.

    Well, in a home network that's exactly what Windows needs to do in order to get security updates -- download EXE and DLL files from the web. So the ET Policy rules are likely to false positive there. So the ET Policy rules in your alerts are most likely false positives. I would suggest you disable the rule set entirely in your configuration or else turn off several of those alerting rules.

    The other alerts from ET Shellcode might not be benign. The fact you mentioned you installed new games and game installers means some kind of adware or malware may have slipped in as well (unless you bought the games from a big-name retailer, but even that's not guaranteed safe). Definitely would be worried if I obtained the games from a torrent or other P2P method or purchased them at a substantial discount off retail from some web site.

    One thing to start with is to research all of the IP addresses in the alerts that are not your own. You can use web tools such as the ARIN IP Lookup to find the IP space owner and what country the IP is registered in. You can also search Google using the IP addresses as the search term to see if any negative reviews turn up.

    If the IP addresses in those Shellcode alerts are registered to the maker of your games, then I wouldn't panic as much as I would if I found the IP addresses instead were going to some "more often than not" hostile country known for malware.

Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.