Upgrade Snort ASAP

hoba

Sounds like memory issues to me. Try to disable some rules or test with only few rules enabled just to confirm this assumption.

keithdrone

I uninstalled it and reinstalled it yet again…. and now it works fine (for now) going on an hour without messing up. I have all the rulesets enabled and AC-sparcebands, same setup i had last time.

So, I'm chalking it up to gremlins. That and the fact that Comcast scans me about a trillion times a day :p Probably testing out that exploit on their customers..... jerks.

Thanks for your help.

yoda715

I would not advise running all rulesets with only 460 Ram. That might be part of your problem. If Snort starts eating up a lot of memory, processes will start to be killed, including snort. I have 1gig and having all rulesets checked pushes me over 600mb.

mbedyn

hmmm My upgraded snort instance runnig fine until today morning, that I saw in my logs

Feb 23 07:23:17 	snort[45790]: FATAL ERROR: Unable to allocate memory! (7566277 bytes in use)
Feb 23 07:23:17 	snort[45790]: FATAL ERROR: Unable to allocate memory! (7566277 bytes in use)
Feb 23 07:13:20 	snort2c[45793]: attack detected non-whitelisted ip: 86.97.202.41 blocked !

:-
Does anybody experienced this?

trendchiller

crazy… when looking at >STATUS >SERVICES snort seems to be stopped... ?

when starting it with the button it tells me to be started and the status still tells me snort to be stopped...

cosmetic error or serious bug ?

When starting in in the CLI it tells me in the last lines:

ERROR: /usr/local/etc/snort/snort.conf(xx) => Unable to open the IIS Unicode Map file '/usr/local/etc/snort/unicode.map'.
Fatal Error, Quitting..

What has happened ?

It's the same error on all my 2 local systems…

Seems to have something to do with the xxx-sample-files in /usr/local/etc/snort/ because snort cannot find the xxx.map-files, because they are NOT present... only the samples...
I have no idea how they are generated, but perhaps it helps ?

You can get it running MANUALLY FROM THE CLI by changing manually in /usr/local/etc/snort/snort.conf
preprocessor http_inspect: global iis_unicode_map unicode.map 1252 to preprocessor http_inspect: global iis_unicode_map unicode.map-sample 1252
include classification.config-sample to include classification.config-sample
include reference.config-sample to include reference.config-sample

or just rename the files above…

yoda715

@trendchiller:

crazy… when looking at >STATUS >SERVICES snort seems to be stopped... ?

when starting it with the button it tells me to be started and the status still tells me snort to be stopped...

cosmetic error or serious bug ?

When starting in in the CLI it tells me in the last lines:

ERROR: /usr/local/etc/snort/snort.conf(xx) => Unable to open the IIS Unicode Map file '/usr/local/etc/snort/unicode.map'.
Fatal Error, Quitting..

What has happened ?

It's the same error on all my 2 local systems…

Seems to have something to do with the xxx-sample-files in /usr/local/etc/snort/ because snort cannot find the xxx.map-files, because they are NOT present... only the samples...
I have no idea how they are generated, but perhaps it helps ?

You can get it running MANUALLY FROM THE CLI by changing manually in /usr/local/etc/snort/snort.conf
preprocessor http_inspect: global iis_unicode_map unicode.map 1252 to preprocessor http_inspect: global iis_unicode_map unicode.map-sample 1252
include classification.config-sample to include classification.config-sample
include reference.config-sample to include reference.config-sample

or just rename the files above…

That is wierd. Never had that trouble. Reinstall Snort and those files will be regenerated.

trendchiller

yes !
looking better :-)

Klexx

Hi , just upgraded but snort wont start? when i'm trying to start it form comandline "snort -d" i get this error msg :

ERROR: /usr/local/etc/snort/snort.conf(42) => Unable to open the IIS Unicode Map file '/usr/local/etc/snort/unicode.map'.
Fatal Error, Quitting..

Is it a minor bug ??

sullrich

Configure it first…

Klexx

@sullrich:

Configure it first…

I reinstalled the pakage , and when i looked at the settings it semed like it was configured ( aka: all settings was the same as before )
after i read your answer i just hit the save button aka resaving the configuration and now it works :-)

Thank you for superb support :-)