Snort problem

Guest

Well it is not really fixed…. netbios rules still get snort to fail.

Use the netbios.rules from the so_rules folder.

Roodawakening

I've tried all of the suggestions contained within this thread and it's still not functioning properly. My PfSense box has been up and running for over 30 hours and not a single Snort alert in all that time. I just don't understand what the problem is. Can anyone advise?

Thanks…

Guest

@Roodawakening:

I've tried all of the suggestions contained within this thread and it's still not functioning properly. My PfSense box has been up and running for over 30 hours and not a single Snort alert in all that time. I just don't understand what the problem is. Can anyone advise?

Thanks…

Do you have any snort rules in the Categories section of snort? If you are using pfsense 1.2.2 version i believe that it's haveing problem updating the rules so you might have to manually download the latest rules from snort.org and do a SSH and also manually install the rules. If you have the latest rules already install than you might have to start the service.

Roodawakening

@1clicc:

@Roodawakening:

I've tried all of the suggestions contained within this thread and it's still not functioning properly. My PfSense box has been up and running for over 30 hours and not a single Snort alert in all that time. I just don't understand what the problem is. Can anyone advise?

Thanks…

Do you have any snort rules in the Categories section of snort? If you are using pfsense 1.2.2 version i believe that it's haveing problem updating the rules so you might have to manually download the latest rules from snort.org and do a SSH and also manually install the rules. If you have the latest rules already install than you might have to start the service.

Ironically, Snort worked perfectly on 1.2.2. The problems started as soon as I "upgraded" to 1.2.3 RC-1. After monkeying with it for far too long, I finally "downgraded" back to 1.2.2–a version known to work on my machine. Unfortunately, Snort doesn't run on 1.2.2 now either. But I appreciate the suggestion. I'll try it again.

mentalhemroids

@Roodawakening:

Ironically, Snort worked perfectly on 1.2.2. The problems started as soon as I "upgraded" to 1.2.3 RC-1. After monkeying with it for far too long, I finally "downgraded" back to 1.2.2–a version known to work on my machine. Unfortunately, Snort doesn't run on 1.2.2 now either. But I appreciate the suggestion. I'll try it again.

I would tell you to try reinstalling snort; there was a problem recently and doing a reinstall corrected my brief issues, so do that first. Then try re-doing your pfSense box. I can't say how many times I've redone mine over problems I didn't understand. Which has got me in hot water with the Mrs. I have changed my setup at least 10 times. I now have two pfSense boxes running snort - the netbios rules + using ac-bnfa and have squid running on the second box behind the first WAN connected pfSense box. If at first you don't succeed, try again.

jamesdean

Hi.

Sorry I have been gone. I just started a new job and have been really busy.

Snort 2.8.4.1 right now does not work because the mysql client port is out of date.

Mysql client needs to be at mysql 5.1, dependencies libdnet-1.11_3.tbz and pcre.7.9 must be installed.

Moreover, It seems that the snort port and the mysql client port were built on different machines.
Sourcefire is using the new RPC2 netbios rules so snort needs to be at snort 2.8.4.1.

My snort.inc is good so theres no need to comment out the RPC2 options.

I emailed the core team on how to fix the package hopefully this will be resolved today.
I'll be hear all day so, please ask and I will respond to any messages.

thanx

firbc

@shaddow501:

Well it is not really fixed…. netbios rules still get snort to fail.

Same problem here.

jamesdean

@firbc:

@shaddow501:

Well it is not really fixed…. netbios rules still get snort to fail.

Same problem here.

reinstall the snort. should work now.

ColdFusion

seems to work now, no errors in log.

thanks for the update..

John

simonchs

i've just reinstalled twice the snort package, but i can't start-up the snort service, here are the log:

May 26 18:35:47 xxxxx snort[23564]: Initializing daemon mode
May 26 18:35:47 xxxxx snort[23564]: Initializing daemon mode
May 26 18:35:47 xxxxx snort[23567]: PID path stat checked out ok, PID path set to /var/run/
May 26 18:35:47 xxxxx snort[23567]: PID path stat checked out ok, PID path set to /var/run/
May 26 18:35:47 xxxxx snort[23567]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_em1.pid" for PID "23567"
May 26 18:35:47 xxxxx snort[23567]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_em1.pid" for PID "23567"
May 26 18:35:48 xxxxx snort[23564]: Child exited unexpectedly
May 26 18:35:48 xxxxx snort[23564]: Child exited unexpectedly
May 26 18:35:48 xxxxx snort[23564]: Daemon parent exiting
May 26 18:35:48 xxxxx snort[23564]: Daemon parent exiting
May 26 18:35:56 xxxxx snort2c[23647]: snort2c running in daemon mode pid: 23647
May 26 18:35:56 xxxxx snort2c[23647]: snort2c running in daemon mode pid: 23647
May 26 18:36:13 xxxxx SnortStartup[23667]: Ram free BEFORE starting Snort: 59M – Ram free AFTER starting Snort: 59M -- Mode ac-bnfa -- Snort memory usage:

i've tried to stop the snort service, remove the file /var/run/snort_em1.pid.lck and start the snort service again, and even reboot my pfsense, but got the same log as above.

any trick?

ColdFusion

Did you update the rules at all after installation? If not update..should start.

Slam

Seems to be working great on pfs 1.2.3 w/dual wan & CP, thanks for the update.

Slam

jamesdean

@simonchs:

i've just reinstalled twice the snort package, but i can't start-up the snort service, here are the log:

May 26 18:35:47 xxxxx snort[23564]: Initializing daemon mode
May 26 18:35:47 xxxxx snort[23564]: Initializing daemon mode
May 26 18:35:47 xxxxx snort[23567]: PID path stat checked out ok, PID path set to /var/run/
May 26 18:35:47 xxxxx snort[23567]: PID path stat checked out ok, PID path set to /var/run/
May 26 18:35:47 xxxxx snort[23567]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_em1.pid" for PID "23567"
May 26 18:35:47 xxxxx snort[23567]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_em1.pid" for PID "23567"
May 26 18:35:48 xxxxx snort[23564]: Child exited unexpectedly
May 26 18:35:48 xxxxx snort[23564]: Child exited unexpectedly
May 26 18:35:48 xxxxx snort[23564]: Daemon parent exiting
May 26 18:35:48 xxxxx snort[23564]: Daemon parent exiting
May 26 18:35:56 xxxxx snort2c[23647]: snort2c running in daemon mode pid: 23647
May 26 18:35:56 xxxxx snort2c[23647]: snort2c running in daemon mode pid: 23647
May 26 18:36:13 xxxxx SnortStartup[23667]: Ram free BEFORE starting Snort: 59M – Ram free AFTER starting Snort: 59M -- Mode ac-bnfa -- Snort memory usage:

i've tried to stop the snort service, remove the file /var/run/snort_em1.pid.lck and start the snort service again, and even reboot my pfsense, but got the same log as above.

any trick?

If any of you are still having problems. Please fallow these steps.

1. Reinstall snort. (So that the new code gets updated.)

2. Deinstall snort. (New code deinstalls all the old snort packages.)

3. Install the snort package.

4. Update the rules.

Finished, snort should work now.

James

simonchs

@ColdFusion:

Did you update the rules at all after installation? If not update..should start.

yes, i've update the rules once the install/re-install complete.

simonchs

@jamesdean:

@simonchs:

i've just reinstalled twice the snort package, but i can't start-up the snort service, here are the log:

May 26 18:35:47 xxxxx snort[23564]: Initializing daemon mode
May 26 18:35:47 xxxxx snort[23564]: Initializing daemon mode
May 26 18:35:47 xxxxx snort[23567]: PID path stat checked out ok, PID path set to /var/run/
May 26 18:35:47 xxxxx snort[23567]: PID path stat checked out ok, PID path set to /var/run/
May 26 18:35:47 xxxxx snort[23567]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_em1.pid" for PID "23567"
May 26 18:35:47 xxxxx snort[23567]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_em1.pid" for PID "23567"
May 26 18:35:48 xxxxx snort[23564]: Child exited unexpectedly
May 26 18:35:48 xxxxx snort[23564]: Child exited unexpectedly
May 26 18:35:48 xxxxx snort[23564]: Daemon parent exiting
May 26 18:35:48 xxxxx snort[23564]: Daemon parent exiting
May 26 18:35:56 xxxxx snort2c[23647]: snort2c running in daemon mode pid: 23647
May 26 18:35:56 xxxxx snort2c[23647]: snort2c running in daemon mode pid: 23647
May 26 18:36:13 xxxxx SnortStartup[23667]: Ram free BEFORE starting Snort: 59M – Ram free AFTER starting Snort: 59M -- Mode ac-bnfa -- Snort memory usage:

i've tried to stop the snort service, remove the file /var/run/snort_em1.pid.lck and start the snort service again, and even reboot my pfsense, but got the same log as above.

any trick?

If any of you are still having problems. Please fallow these steps.

1. Reinstall snort. (So that the new code gets updated.)

2. Deinstall snort. (New code deinstalls all the old snort packages.)

3. Install the snort package.

4. Update the rules.

Finished, snort should work now.

James

thanks James, still no luck, same log shown as above post. the "snort" can't start while the "snort2c" can run.

simonchs

i've just modified /usr/local/etc/rc.d/snort.sh and changed:
snort -c /usr/local/etc/snort/snort.conf -l /var/log/snort -D -i em1 -A fast -q
to:
snort -c /usr/local/etc/snort/snort.conf -l /var/log/snort -i em1 -A fast -q &
then the snort work properly

is there any way to trace the problem?

thanks.

firbc

I have similar problem:

snort[1317]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_xl0.pid" for PID "1317"
snort[1317]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_xl0.pid" for PID "1317"

Also snort do not work after reboot. It starts, it is also loaded to memory but not working. I have to clean alert logs and after that snort restart itself and then start to work.

jamesdean

Hey firbc, simonchs..

Can you guys tell me what version of pfsense your running. I have a feeling its 1.2 and not 1.2.3.

Also, please tell me whats the output of "pkg_info".

Help me help you.
james

simonchs

running pfsense 1.2.2

and the output of pkg_info:

arc-5.21o_1 Create & extract files from DOS .ARC files
arj-3.10.22_1 Open-source ARJ
bandwidthd-2.0.1_1 Tracks bandwidth usage by IP address
clamav-0.93.1_2 Command line virus scanner written entirely in C
gd-2.0.35,1 A graphics library for fast creation of images
havp-0.88 HTTP Antivirus Proxy
jpeg-6b_4 IJG's jpeg compression utilities
lha-1.14i_6 Archive files using LZSS and Huffman compression (.lzh file
libdnet-1.11_3 A simple interface to low level networking routines
libgmp-4.2.2 A free library for arbitrary precision arithmetic
libiconv-1.11_1 A character set conversion library
lightsquid-1.7.1_1 A light and fast web based squid proxy traffic analyser
mysql-client-5.1.34 Multithreaded SQL database (client)
openldap-client-2.4.10 Open source LDAP client implementation
openldap-client-2.4.11 Open source LDAP client implementation
p5-GD-2.39 A perl5 interface to Gd Graphics Library version2
pcre-7.9 Perl Compatible Regular Expressions library
perl-5.8.8_1 Practical Extraction and Report Language
snort-2.8.4.1 Lightweight network intrusion detection system
squid-2.6.21 HTTP Caching Proxy
squid_radius_auth-1.10 RADIUS authenticator for squid proxy 2.5 and later
unzoo-4.4_2 A zoo archive extractor

jamesdean

Simochs

Your setup looks fine.

Have you tryed this.
Type this in the terminal "rm -r /var/run/snort*"

Restart snort.

If snort still fails type this in so that I can have a better output of the error.

"snort -c /usr/local/etc/snort/snort.conf -l /var/log/snort -v -i ng0 -A fast"

Help me help you
James