Snort not working for me (again)

[yoda715]

Can you describe any changes that you made prior and up to you noticing that snort stopped working? I will see if I can duplicate.

[PC_Arcade]

None, I just started using the latest snapshot, I re-installed from scratch as well as something in my old xml backup caused pfsense to not boot :(

I THINK it's caused by the fact I'm using DHCP and therefore the staticIP box is blank, it's the only /32 I can find with no IP address allocated (as I'm on a /24 network)

[yoda715]

@PC_Arcade:

I THINK it's caused by the fact I'm using DHCP and therefore the staticIP box is blank, it's the only /32 I can find with no IP address allocated (as I'm on a /24 network)

Are you referring to DHCP on the WAN interface?

[PC_Arcade]

@sdale:

@PC_Arcade:

I THINK it's caused by the fact I'm using DHCP and therefore the staticIP box is blank, it's the only /32 I can find with no IP address allocated (as I'm on a /24 network)

Are you referring to DHCP on the WAN interface?

Sorry, I should have been clearer. Yes, DHCP on the WAN interface, the Static box on the WAN interface is the only occurence of /32 that I can find

[yoda715]

Hmm. That shouldn't have any problems. I am using DHCP on the WAN interface and it enters the correct WAN IP for me.

[PC_Arcade]

I wouldn't read anything into it, I'm clutching at straws  ;D

[yoda715]

No clue. I will update to the latest snapshot later and see if I have any troubles. Im running 12-19 snapshot right now with no problems.

[PC_Arcade]

Thanks sdale, your help is much appreciated

[yoda715]

I updated to the 1-19 snapshot and snort is running properly for me. Not sure what could be your problem. ???

[Guest]

Any chance you're trying to run snort on multiple interfaces?

[PC_Arcade]

@submicron:

Any chance you're trying to run snort on multiple interfaces?

None whatsoever :(

Weird, I'll stop using it again then.

[PC_Arcade]

Probably, however what I don't understand is how it's picking up an incorrect setting in the first place

I'll try your suggestion later

[PC_Arcade]

OK, this is the line in my snort.conf :

var HOME_NET [192.168.1.0/24,/32,86.3.142.145,192.168.1.2,,]

however if I remove the ,/32, the file gets recreated when I save snort config and overwrites any changes I make :(

any ideas?

I can post the entire snort.conf file and the startup logs if it helps?

There is another warning in the snort starup log though :
snort[13576]: WARNING /usr/local/etc/snort/snort.conf(36) => flush_behavior set in config file, using old static flushpoints (0)

Does that shed any light?

[yoda715]

Do you remember if you recently updated your snort rules before you started having troubles?

[PC_Arcade]

The rules were updated, BUT so was my entire machine, I changed to the 19th's image (cos of the lovely new look gui!) and reinstalled from scratch, everything was upgraded

[yoda715]

I'm not sure why, but I have problems starting snort when I have web-misc category checked. If you have that ruleset enabled, try disabling it and see if Snort will start up.

[PC_Arcade]

Not ticked, could this thread shed any light (or at least point to the fact that there's something odd going on with the HOME_NET line?) : http://forum.pfsense.org/index.php/topic,3427.0.html

[sullrich]

@PC_Arcade:

Not ticked, could this thread shed any light (or at least point to the fact that there's something odd going on with the HOME_NET line?) : http://forum.pfsense.org/index.php/topic,3427.0.html

No, because that has already been fixed.

[PC_Arcade]

Has it?? What snapshot was it fixed in?

[sullrich]

@PC_Arcade:

Has it?? What snapshot was it fixed in?

Those files do not reside in a snapshot.  They are on the server… Its a package file, not a base file.