Snort not updating?

eethore

i have the same trouble…

uninstalling snort

hiks...hiks... :'(

darwinmach

Still some problems with snort. Whenever I open the snort blocked list (https://10.0.0.138/snort_blocked.php) the webgui would hang.

I see the same issues. Also noticed that while it gets stuck… a PHP process goes up to 100% CPU load.

I tried using the blocked page on HTTP instead of HTTPS, as the logs seem to indicate the the issue is with OpenSSL, still the same issue.

Can anyone tell me where the snort_blocked.php file is located? I kinda want to take a look at it...

adrianhensler

# find / -name snort_blocked.php
/usr/local/www/snort_blocked.php

:)

darwinmach

cool thanks :P

Darkk

@darwinmach:

@tekkon:

Still some problems with snort. Whenever I open the snort blocked list (https://10.0.0.138/snort_blocked.php) the webgui would hang.

I see the same issues. Also noticed that while it gets stuck… a PHP process goes up to 100% CPU load.

I tried using the blocked page on HTTP instead of HTTPS, as the logs seem to indicate the the issue is with OpenSSL, still the same issue.

Can anyone tell me where the snort_blocked.php file is located? I kinda want to take a look at it...

At first I thought maybe I have an older hardware like PIII with 512MB of ram but seeing this glad to know I am not the only one experiencing this.

Visseroth

I'd like to state that I am having the same problem. The furthest I get is "Downloading current snort rules….." and nothing happens after that. It shows the link at which it is downloading and nothing.

If anyone has any ideas I have 2 routers that are doing the exact same thing that we can test on. Feel free to contact me via ëmal visseroth a t g mail d 0 t c0m.

jimp

@Visseroth:

I'd like to state that I am having the same problem. The furthest I get is "Downloading current snort rules….." and nothing happens after that. It shows the link at which it is downloading and nothing.

If anyone has any ideas I have 2 routers that are doing the exact same thing that we can test on. Feel free to contact me via ëmal visseroth a t g mail d 0 t c0m.

Try this:
http://doc.pfsense.org/index.php/Why_won%27t_snort_properly_download_rules%3F

Which also links to this relevant forum post:
http://forum.pfsense.org/index.php/topic,13333.0.html

Visseroth

Well I highly doubt that it's a slow network problem as I have 6Meg down and it's consistent and I have tried updating numerous times before consulting the forums but none the less, I am going to update to the 1.2.3 and see what happens. I'll post back shortly if it fixes my oinker.

Edit:
OK, so I downloaded 1.2.3-2 update as of the 15th and it breaks my firewall enough that I can not get any internet through the firewall and PfSense complains that it's unable to load some rules so I am taking it back to 1.2.2 until the 1.2.3 final is released, I just wish that Snort would quite breaking between releases and updates.

Question: When is the 1.2.3 release expected and if it'll be a while is there a temporary fix for this issue that seems to be plaguing everyone?

tomom

Snort package is working in 1.2.2? Updating is fixed?

Visseroth

Nope, not that I've noticed. I have 3 boxes that are not updating correctly. They get stuck at updating and will gradually say downloading but that's as far as it ever gets.

At this point any suggestions are greatly appreciated as I have found no answers that work.

Darkk

I wonder if Snort have an issue with MySQL as it uses it to create tables and keeping track of the blocks.

drarkanex

Snort Updating is fixed in Current 2.0 alpha. I haven't had a problem with it thus far.

Visseroth

That's great but 2.0 is still alpha, when is it going beta and when is it going to be final?