Snort problem
-
have you tried what we've done so far or knocking down your rules to just icmp or something that you know you would get alerts if you had it enabled? What is your system specs? (cpu/ram?)
-
I've got a stange issue with snort as well… after gracefully shutting down my network for a week later I brought PFS back up and updated Snort rules... I now have this message in my log:
snort[3004]: FATAL ERROR: Warning: /usr/local/etc/snort/rules/netbios.rules(24) => Unknown keyword ' dce_iface' in rule!
I can't locate that reference in any of the netbios.rules and the Snort Service does appear to be running (in services menu) and stays up but no alerts and nothing is being blocked… I would say it's not working correctly if at all.
I've tried both reinstalling and uninstalling the package already and no help there… any ideas would be appreciated!
You know what's strange about this also is I get the same error on my other PF box with Snort version
2.6.21_10, but I don't get it on my other PF box that has version 2.6.21_08. Both have latest rules from 5/11/09. -
I think that the problems with the shoulder quantity reserved for snort
-
The issues with the netbios rules are most likely due to sourcefire revamping of the ruleset. They have added some extra preprocessors to handle the recent MS08-067 vulnerabilities.
Check this out if you want more information:
http://isc.sans.org/diary.html?storyid=6151 -
Seems about right. Just updated rules to 5/14 and get the error now on this pf box.
-
I've got a stange issue with snort as well… after gracefully shutting down my network for a week later I brought PFS back up and updated Snort rules... I now have this message in my log:
snort[3004]: FATAL ERROR: Warning: /usr/local/etc/snort/rules/netbios.rules(24) => Unknown keyword ' dce_iface' in rule!
I can't locate that reference in any of the netbios.rules and the Snort Service does appear to be running (in services menu) and stays up but no alerts and nothing is being blocked… I would say it's not working correctly if at all.
I've tried both reinstalling and uninstalling the package already and no help there… any ideas would be appreciated!
You know what's strange about this also is I get the same error on my other PF box with Snort version
2.6.21_10, but I don't get it on my other PF box that has version 2.6.21_08. Both have latest rules from 5/11/09.Thanks for the feedback on this… Wish I could say that I have another sugesstion but I don't.
-
Can anyone help me with this error that i got with snort. I don't know what it means but i have 2GB or ram and only 12% is only beening used.
May 22 01:15:15 snort[14339]: FATAL ERROR: Misconfigured dynamic preprocessor(s)
May 22 01:15:15 snort[14339]: FATAL ERROR: Misconfigured dynamic preprocessor(s)
May 22 01:15:32 SnortStartup[14422]: Ram free BEFORE starting Snort: 112M – Ram free AFTER starting Snort: 112M -- Mode ac-sparsebands -- Snort memory usage:May 22 01:23:22 snort[1843]: Alert on commands: None
May 22 01:23:22 snort[1843]: /usr/local/etc/snort/snort.conf(276) unknown dynamic preprocessor "dcerpc2"
May 22 01:23:22 snort[1843]: /usr/local/etc/snort/snort.conf(276) unknown dynamic preprocessor "dcerpc2"
May 22 01:23:22 snort[1843]: /usr/local/etc/snort/snort.conf(277) unknown dynamic preprocessor "dcerpc2_server"
May 22 01:23:22 snort[1843]: /usr/local/etc/snort/snort.conf(277) unknown dynamic preprocessor "dcerpc2_server"Thanks guys.
-
Do you have netbios rules enabled?? Seems to be an issue if you look at the previous posts…I found this that's why I asked??
www.snort.org/vrt/tools/using-dcerpc2.html -
@1clicc:
Can anyone help me with this error that i got with snort. I don't know what it means but i have 2GB or ram and only 12% is only beening used.
[snip]The snort package is being updated, but there is an issue with it that didn't get fixed last night. Hopefully it will get fixed at some point today.
-
Do you have netbios rules enabled?? Seems to be an issue if you look at the previous posts…I found this that's why I asked??
www.snort.org/vrt/tools/using-dcerpc2.htmlNope i don't have netbois rules enable.
Do you have netbios rules enabled?? Seems to be an issue if you look at the previous posts…I found this that's why I asked??
www.snort.org/vrt/tools/using-dcerpc2.htmlIt couble be because i just install snort last night. When do you think this will be fix?
-
@1clicc:
It couble be because i just install snort last night. When do you think this will be fix?
Last I heard they were waiting to hear back from the person who submitted the updated package. If it can't be made to work, I imagine it will get rolled back to the last working version. You can watch the package commit logs to see if anything has changed:
https://rcs.pfsense.org/projects/pfsense-packages
-
Hope this can be resolve very soon. Please do keep us updated when there's a fix. Thanks you.
-
Hey guys, may i have the previous working version because i think this going to be awhile before it will be fix. Anyone know where i can download the previous version? and how would i manually install it? Thanks and much appreciation.
-
Hello Guys
attached please find the snort.inc that now fix the problem, and snort is running again.
the thing is I have disabled the new "dcerpc2" & "dcerpc2_server" and got back to the old "dcerpc" that does exist.go to Edit file under pfsense menu and load: /usr/local/pkg/snort.inc and replace the content of this file with the one that is attached.
thats it, snort will be working perfectly now.good luck. :)
-
Hello Guys
attached please find the snort.inc that now fix the problem, and snort is running again.
the thing is I have disabled the new "dcerpc2" & "dcerpc2_server" and got back to the old "dcerpc" that does exist.go to Edit file under pfsense menu and load: /usr/local/pkg/snort.inc and replace the content of this file with the one that is attached.
thats it, snort will be working perfectly now.good luck. :)
Actually i got this error now:
May 23 10:18:54 snort[2335]: FATAL ERROR: /usr/local/etc/snort/snort.conf(214) => FTP Commands are no longer than 4 characters: '#MACB'.
May 23 10:18:54 snort[2335]: FATAL ERROR: /usr/local/etc/snort/snort.conf(214) => FTP Commands are no longer than 4 characters: '#MACB'.
May 23 10:19:11 SnortStartup[2408]: Ram free BEFORE starting Snort: 88M – Ram free AFTER starting Snort: 88M -- Mode ac-sparsebands -- Snort memory usage:Any recommendation? because snort is not start also.
-
Its mean that you didn't save the file correctly cause the change wasn't implemented.
after implementing the file you need to save. and then save again in the snort setting page.also I have checked and the netbios rules should not be checked till the dcerpc2 and dcerpc2_server, will be compiled correctly into the snort package
-
this is fixed in the package now
-
What is fixed?
i do not see any package update?
can you please be more specific what is fixed? and how? did you add the preprocessor "dcerpc2" and the preprocessor "dcerpc2_server" ?
or just modify the snort.inc to disable the use of them? -
@cmb:
this is fixed in the package now
OK, Confirm that it is now working after i uninstall and reinstall from the package. Thanks guys you guys are highly appreciated.
-
Well it is not really fixed…. netbios rules still get snort to fail.
