Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Suricata process dying due to hyperscan problem

    Scheduled Pinned Locked Moved IDS/IPS
    295 Posts 25 Posters 111.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • bmeeksB
      bmeeks
      last edited by bmeeks

      My pull request containing the anticipated fix for this Hyperscan error has been merged. An updated Suricata package has built and should appear as an available update for 2.7.2 CE and 23.09.1 Plus users.

      Look for an update to version 7.0.2_2 for the Suricata package. When installed, the new package should pull in version 7.0.2_5 of the Suricata binary.

      Fingers crossed this fixes the Hyperscan issue. But as I mentioned previously, since I could never reproduce the error in my small test environment, I can't say with 100% certainty the bug I found and fixed is the actual Hyperscan culprit.

      N kiokomanK tylereversT 3 Replies Last reply Reply Quote 2
      • N
        NRgia @bmeeks
        last edited by NRgia

        @bmeeks said in Suricata process dying due to hyperscan problem:

        My pull request containing the anticipated fix for this Hyperscan error has been merged. An updated Suricata package has built and should appear as an available update for 2.7.2 CE and 23.09.1 Plus users.

        Look for an update to version 7.0.2_2 for the Suricata package. When installed, the new package should pull in version 7.0.2_5 of the Suricata binary.

        For 23.09.1 I can confirm that it is available.
        After the update I can see these packages

        pfSense-pkg-suricata-7.0.2_2   pfSense package suricata
        suricata-7.0.2_5               High Performance Network IDS, IPS and Security Monitoring engine
        
        

        Thank you

        1 Reply Last reply Reply Quote 0
        • kiokomanK
          kiokoman LAYER 8 @bmeeks
          last edited by

          @bmeeks
          tested

          and .....

          dcfb4ce9-353a-4416-a9f5-14bb3e50fe54-image.png

          not working.. 😀

          [340341 - RX#01-vmx2] 2023-12-11 22:42:50 Info: checksum: No packets with invalid checksum, assuming checksum offloading is NOT used
          [340346 - W#05] 2023-12-11 22:42:53 Error: spm-hs: Hyperscan returned fatal error -1.
          [340347 - W#06] 2023-12-11 22:42:53 Error: spm-hs: Hyperscan returned fatal error -1.

          ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
          Please do not use chat/PM to ask for help
          we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
          Don't forget to Upvote with the 👍 button for any post you find to be helpful.

          bmeeksB 1 Reply Last reply Reply Quote 0
          • bmeeksB
            bmeeks @kiokoman
            last edited by

            @kiokoman said in Suricata process dying due to hyperscan problem:

            @bmeeks
            tested

            and .....

            dcfb4ce9-353a-4416-a9f5-14bb3e50fe54-image.png

            not working.. 😀

            [340341 - RX#01-vmx2] 2023-12-11 22:42:50 Info: checksum: No packets with invalid checksum, assuming checksum offloading is NOT used
            [340346 - W#05] 2023-12-11 22:42:53 Error: spm-hs: Hyperscan returned fatal error -1.
            [340347 - W#06] 2023-12-11 22:42:53 Error: spm-hs: Hyperscan returned fatal error -1.

            Well, crap! I had high hopes.

            Does it still work if you disable blocking mode?

            kiokomanK 1 Reply Last reply Reply Quote 0
            • kiokomanK
              kiokoman LAYER 8 @bmeeks
              last edited by

              @bmeeks
              yes, it's running on an interface i have without blocking mode

              ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
              Please do not use chat/PM to ask for help
              we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
              Don't forget to Upvote with the 👍 button for any post you find to be helpful.

              bmeeksB 1 Reply Last reply Reply Quote 0
              • bmeeksB
                bmeeks @kiokoman
                last edited by

                @kiokoman said in Suricata process dying due to hyperscan problem:

                @bmeeks
                yes, it's running on an interface i have without blocking mode

                Please share the output of this command run from a shell prompt:

                pkg info | grep suricata
                

                Let's make sure you have the latest binary. It should show suricata-7.0.2_5.

                kiokomanK 1 Reply Last reply Reply Quote 0
                • kiokomanK
                  kiokoman LAYER 8 @bmeeks
                  last edited by kiokoman

                  @bmeeks

                  5adf5f89-7bd2-4c32-b26e-8a3c1c76d614-image.png

                  Shell Output - pkg info | grep suricata
                  pfSense-pkg-suricata-7.0.2_2 pfSense package suricata
                  suricata-7.0.2_5 High Performance Network IDS, IPS and Security Monitoring engine

                  this is pfsense 2.7.2
                  the strange part is that i have another pfsense 23.09.1-RELEASE that it's running on vmware with the same packages and more vlans but it have no trouble ....
                  the only difference is that 23.09.1 is running with 4 cpu and 2.7.2 with 8 cpu
                  tomorrow i can try to lower the cpu and see if there is any difference

                  ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
                  Please do not use chat/PM to ask for help
                  we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
                  Don't forget to Upvote with the 👍 button for any post you find to be helpful.

                  1 Reply Last reply Reply Quote 0
                  • NeganN
                    Negan
                    last edited by

                    Still broken here also..... :-(

                    [177766 - RX#01-ix0] 2023-12-12 06:48:02 Info: checksum: More than 1/10th of packets have an invalid checksum, assuming checksum offloading is used (193/1000)
                    [177768 - W#02] 2023-12-12 07:17:29 Error: spm-hs: Hyperscan returned fatal error -1.

                    1 Reply Last reply Reply Quote 0
                    • P
                      paulp
                      last edited by paulp

                      After upgrade, the problem with the hyperscan error still occurs for me as well.

                      1 Reply Last reply Reply Quote 0
                      • bmeeksB
                        bmeeks
                        last edited by bmeeks

                        Well, sorry but I'm fresh out of ideas at this point. I have no clue what it could be. That fix was my last best hope.

                        Since I cannot reproduce the problem, it makes it practically impossible to troubleshoot and debug.

                        M 1 Reply Last reply Reply Quote 0
                        • M
                          Maltz @bmeeks
                          last edited by

                          @bmeeks I think I mentioned it somewhere else, too, but the problem only occurs for me (Netgate 2100) when I have DNSBL (pfBlocker) running also. Have you tried that combo to reproduce? (Or at least occurs much faster - I've only run it for a few days in a row with DNSBL disabled, but when both are running, Suricata dies within 5-15 minutes.)

                          1 Reply Last reply Reply Quote 0
                          • NeganN
                            Negan
                            last edited by

                            I should have also mentioned I'm running a Netgate 8200,..

                            1 Reply Last reply Reply Quote 0
                            • P
                              paulp
                              last edited by

                              I also have pfBlockerBG active. I will uninstall it to see if the problem still occurs.

                              @bmeeks: On one of my pfsense servers the problem manifests itself relatively quickly - a few hours.
                              I would be happy if I could somehow help to identify the problem.

                              1 Reply Last reply Reply Quote 0
                              • S
                                sgnoc
                                last edited by

                                Not sure why, but I haven't had a single segfault kill my suricata interfaces running auto on my netgate 7100 for the last few hours, after the upgrade. It would have normally long since had the hyperscan error and core dumped the process. I'm keeping an eye on it, but so far so good.

                                1 Reply Last reply Reply Quote 0
                                • BismarckB
                                  Bismarck
                                  last edited by

                                  Same here with pattern match auto or blocking enabled, suricata still won't start.

                                  abad38b2-186c-489c-b059-29564404f81e-image.png

                                  pkg info | grep suricata
                                  pfSense-pkg-suricata-7.0.2_2   pfSense package suricata
                                  suricata-7.0.2_5               High Performance Network IDS, IPS and Security Monitoring engine
                                  
                                  bmeeksB 1 Reply Last reply Reply Quote 0
                                  • NeganN
                                    Negan
                                    last edited by

                                    Output from my 8200

                                    pkg info | grep suricata

                                    pfSense-pkg-suricata-7.0.2_2 pfSense package suricata
                                    suricata-7.0.2_5 High Performance Network IDS, IPS and Security Monitoring engine

                                    1 Reply Last reply Reply Quote 0
                                    • P
                                      paulp
                                      last edited by

                                      I uninstalled pfBlockerNG, but the error persists on the wan interface.
                                      (It is a hyper-v machine with Pfsense 23.09.1-RELEASE with suricata-7.0.2_5)

                                      1 Reply Last reply Reply Quote 0
                                      • bmeeksB
                                        bmeeks @Bismarck
                                        last edited by bmeeks

                                        @Bismarck said in Suricata process dying due to hyperscan problem:

                                        Same here with pattern match auto or blocking enabled, suricata still won't start.

                                        What error do you get on startup if you leave the Pattern Matcher set to AC-KS but enable only blocking? In other words, enable blocking but do not change the Pattern Matcher setting.

                                        Show the output of the suricata.log file for the impacted interface (located under the LOGS VIEW tab) and also post anything relevant during the same time from the pfSense system log (under STATUS > SYSTEM LOGS).

                                        BismarckB 1 Reply Last reply Reply Quote 0
                                        • BismarckB
                                          Bismarck @bmeeks
                                          last edited by

                                          @bmeeks no error, "pattern match auto" or "blocking enabled" kills suricata. AC-KS or "disabling blocking" is fine.

                                          bmeeksB 1 Reply Last reply Reply Quote 0
                                          • bmeeksB
                                            bmeeks @Bismarck
                                            last edited by

                                            @Bismarck said in Suricata process dying due to hyperscan problem:

                                            @bmeeks no error, "pattern match auto" or "blocking enabled" kills suricata. AC-KS or "disabling blocking" is fine.

                                            Help me understand this better...

                                            I've gotten a lot of seemingly conflicting information from the posters in this long thread. My confusion is leading to frustration 😧.

                                            1. So if you leave Pattern Matching at AC-KS and enable blocking, Suricata starts and runs with no issue. Is that correct?

                                            2. The only way to make it crash is to set Pattern Matcher to Auto with blocking enabled? Is that correct?

                                            3. And just to close the loop- if you set Pattern Matcher to Auto but disable blocking Suricata starts without error. Is that correct?

                                            For the crash configurations, what is the output of the suricata.log file? Is it always the "Hyperscan returned fatal error -1" message?

                                            BismarckB 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.