Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort problem

    Scheduled Pinned Locked Moved pfSense Packages
    104 Posts 21 Posters 48.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F Offline
      firbc
      last edited by

      I have similar problem:

      snort[1317]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_xl0.pid" for PID "1317"
      snort[1317]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_xl0.pid" for PID "1317"

      Also snort do not work after reboot. It starts, it is also loaded to memory but not working.  I have to clean alert logs and after that snort restart itself and then start to work.

      1 Reply Last reply Reply Quote 0
      • J Offline
        jamesdean
        last edited by

        Hey firbc, simonchs..

        Can you guys tell me what version of pfsense your running. I have a feeling its 1.2 and not 1.2.3.

        Also, please tell me whats the output of "pkg_info".

        Help me help you.
        james

        1 Reply Last reply Reply Quote 0
        • S Offline
          simonchs
          last edited by

          running pfsense 1.2.2

          and the output of pkg_info:

          arc-5.21o_1        Create & extract files from DOS .ARC files
          arj-3.10.22_1      Open-source ARJ
          bandwidthd-2.0.1_1  Tracks bandwidth usage by IP address
          clamav-0.93.1_2    Command line virus scanner written entirely in C
          gd-2.0.35,1        A graphics library for fast creation of images
          havp-0.88          HTTP Antivirus Proxy
          jpeg-6b_4          IJG's jpeg compression utilities
          lha-1.14i_6        Archive files using LZSS and Huffman compression (.lzh file
          libdnet-1.11_3      A simple interface to low level networking routines
          libgmp-4.2.2        A free library for arbitrary precision arithmetic
          libiconv-1.11_1    A character set conversion library
          lightsquid-1.7.1_1  A light and fast web based squid proxy traffic analyser
          mysql-client-5.1.34 Multithreaded SQL database (client)
          openldap-client-2.4.10 Open source LDAP client implementation
          openldap-client-2.4.11 Open source LDAP client implementation
          p5-GD-2.39          A perl5 interface to Gd Graphics Library version2
          pcre-7.9            Perl Compatible Regular Expressions library
          perl-5.8.8_1        Practical Extraction and Report Language
          snort-2.8.4.1      Lightweight network intrusion detection system
          squid-2.6.21        HTTP Caching Proxy
          squid_radius_auth-1.10 RADIUS authenticator for squid proxy 2.5 and later
          unzoo-4.4_2        A zoo archive extractor

          1 Reply Last reply Reply Quote 0
          • J Offline
            jamesdean
            last edited by

            Simochs

            Your setup looks fine.

            Have you tryed this.
            Type this in the terminal "rm -r /var/run/snort*"

            Restart snort.

            If snort still fails type this in so that I can have a better output of the error.

            "snort -c /usr/local/etc/snort/snort.conf -l /var/log/snort -v -i ng0 -A fast"

            Help me help you
            James

            1 Reply Last reply Reply Quote 0
            • S Offline
              simonchs
              last edited by

              yes, i've tried "rm -r /var/run/snort*" and restart snort, still failed.

              when i type "snort -c /usr/local/etc/snort/snort.conf -l /var/log/snort -v -i ng0 -A fast", snort keep running and do not have error. as my previous modify to /usr/local/etc/rc.d/snort.sh, i can run snort without -D parameter.

              so i guess the snort binary cannot "daemonize" itself?

              1 Reply Last reply Reply Quote 0
              • J Offline
                jamesdean
                last edited by

                That is a realy wierd error ? I have never seen a error in snort were -D is the cause.

                What version of 1.2.2 do you have scmochs ?

                Right now Im runing 1.2.3. So im going to have to install 1.2 and retest snort.
                Then im going to install all your packages and try to reproduce your error.

                If there are no errors when I install pfsense 1.2 with the new snort package then you need a fresh install, mabe pfsense 1.2.3.

                Get some sleep, I will figure this out.

                help me help you
                rob

                1 Reply Last reply Reply Quote 0
                • S Offline
                  simonchs
                  last edited by

                  i'm running pfsense version 1.2.2

                  thanks James

                  1 Reply Last reply Reply Quote 0
                  • J Offline
                    jamesdean
                    last edited by

                    @simonchs:

                    i'm running pfsense version 1.2.2

                    thanks James

                    Theres usually a date like mine says

                    1.2.3-RC1
                    built on Wed Apr 22 15:36:34 EDT 2009

                    1 Reply Last reply Reply Quote 0
                    • F Offline
                      firbc
                      last edited by

                      @jamesdean:

                      Hey firbc, simonchs..

                      Can you guys tell me what version of pfsense your running. I have a feeling its 1.2 and not 1.2.3.

                      Also, please tell me whats the output of "pkg_info".

                      Help me help you.
                      james

                      I am running version 1.2.3-RC1, built on Fri May 22 16:32:57 EDT 2009 of pfSense.

                      bandwidthd-2.0.1_1  Tracks bandwidth usage by IP address
                      gd-2.0.35,1        A graphics library for fast creation of images
                      grub-0.97_1        GRand Unified Bootloader
                      jpeg-6b_4          IJG's jpeg compression utilities
                      libdnet-1.11_3      A simple interface to low level networking routines
                      libiconv-1.11_1    A character set conversion library
                      libosip-3.1.0      A low layer of SIP implementation
                      mysql-client-5.0.77_1 Multithreaded SQL database (client)
                      mysql-client-5.1.34 Multithreaded SQL database (client)
                      packages            BSD Installer mega-package
                      pcre-7.8            Perl Compatible Regular Expressions library
                      pcre-7.9            Perl Compatible Regular Expressions library
                      siproxd-0.7.0_1    A proxy/masquerading daemon for the SIP protocol
                      snort-2.8.4.1      Lightweight network intrusion detection system

                      Any idea? Thx

                      1 Reply Last reply Reply Quote 0
                      • J Offline
                        jamesdean
                        last edited by

                        Fixed the problem waiting for new snort packages to be built.

                        Please be pationant.

                        Snort will be working on pfsense 1.2.2 soon.

                        james

                        1 Reply Last reply Reply Quote 0
                        • ? This user is from outside of this forum
                          Guest
                          last edited by

                          Welp i'm having similar problem with snort too.  I reinstalled a fresh copy of pfsense 1.2.2 because i mess it up and when it was running i had snort running beautifully until i reinstall snort after i did a fresh install of pfsense.  Before i install Snort i looked at the platform and it was for 1.2.3 but i was hoping it would work for 1.2.2 but i guess not.  Will the fix be up soon?  I would also like to suggest or request something from the pfsense team to put up multiple applicatoin for different platform so we won't get confuse.
                          For example:  Snort 1.2.2
                                            Snort 1.2.3
                          Instead of a just single update.  Anyhow, you guys are doing a great job and we all appreciated.  Please let us know when the fix is up.  Thanks for everything.  Look foward to the fix.

                          1 Reply Last reply Reply Quote 0
                          • L Offline
                            lordarcane
                            last edited by

                            I´ll guess that my problem is related to the fact that I updated snort and now i´m unable to update the rules. Getting md5 signature mismatch and snort refuses to start.

                            1 Reply Last reply Reply Quote 0
                            • J Offline
                              jamesdean
                              last edited by

                              @lordarcane:

                              I´ll guess that my problem is related to the fact that I updated snort and now i´m unable to update the rules. Getting md5 signature mismatch and snort refuses to start.

                              Thanx for the heads up. Snort.org changed there md5 format to day to go along with there nice new website.

                              From this > c2844479ed68cc0f13ab61f69e35bc7a

                              To this >MD5 (snortrules-snapshot-2.8.tar.gz) = c2844479ed68cc0f13ab61f69e35bc7a

                              Going have to code a fix.
                              Man Snort Package is killing me this week.
                              If they change it back after I code a fix, Im going on a vacation ASAP.

                              james

                              1 Reply Last reply Reply Quote 0
                              • M Offline
                                mentalhemroids
                                last edited by

                                My thanks to JamesDean and anyone else working on this problem.  I know others appreciate the hard work done with this and all other packages.  It's not a easy task keeping up with technology, or life for that matter.

                                Thanks!

                                1 Reply Last reply Reply Quote 0
                                • ? This user is from outside of this forum
                                  Guest
                                  last edited by

                                  So has there been a fix?

                                  1 Reply Last reply Reply Quote 0
                                  • S Offline
                                    serialdie
                                    last edited by

                                    Waiting for the MD5 fix as well :)

                                    TIA!

                                    1 Reply Last reply Reply Quote 0
                                    • ? This user is from outside of this forum
                                      Guest
                                      last edited by

                                      Can anyone tell me if this is normal?

                                      May 31 12:56:05 snort[12638]: Warning: flowbits key 'PtakkS_Keepalive' is set but not ever checked. 
May 31 12:56:05 snort[12638]: Warning: flowbits key 'dce.bind.wkssvc' is set but not ever checked. 
May 31 12:56:05 snort[12638]: Warning: flowbits key 'dce.bind.wkssvc' is set but not ever checked. 
May 31 12:56:05 snort[12638]: Warning: flowbits key 'snipernet' is set but not ever checked. 
May 31 12:56:05 snort[12638]: Warning: flowbits key 'snipernet' is set but not ever checked. 
May 31 12:56:05 snort[12638]: 316 out of 512 flowbits in use. 
May 31 12:56:05 snort[12638]: 316 out of 512 flowbits in use.

                                      Thank you.

                                      1 Reply Last reply Reply Quote 0
                                      • J Offline
                                        jamesdean
                                        last edited by

                                        I updated the the snort package today to fix the md5 error and snort.org's new oink code verification urls for rule updates.

                                        Snort should work but there might be errors when snort.org goes down.
                                        I still need to add code for primium snort.org oink users and clean up the code.
                                        Have patience.

                                        I need people to install the snort package post here. Post failers and success here. Please post your pfsense version and system specs.
                                        Remember to update the rules befor starting snort after reinstall.

                                        If anyone cares this is what happened this month with the snort package.

                                        1. Snort.org changed there code codebase for rpc, result broke the pfsense snort packge.

                                        2. I fixed the snort package.

                                        3. Snort.org changed there md5 checksum format, result broke the pfsense snort packge.

                                        4. I fixed the snort package.

                                        5. Snort.org changed there urls, result broke the pfsense snort packge.

                                        6. I fixed the snort package.

                                        7. Snort.org changed there new oink code verification system , result broke the pfsense snort packge.

                                        8. I fixed the snort package. All is good so far.

                                        Thanx
                                        James

                                        P.S. 1clicc

                                        Its normal.
                                        Snort is just telling you you need to adjust your rules for your system. Read the snort manual for more help.

                                        1 Reply Last reply Reply Quote 0
                                        • AhnHELA Offline
                                          AhnHEL
                                          last edited by

                                          So far so good on my custom micro-atx box.  Startup completed with:

                                          May 31 18:50:37 SnortStartup[59091]: Ram free BEFORE starting Snort: 112M – Ram free AFTER starting Snort: 112M -- Mode ac-bnfa -- Snort memory usage:
                                          May 31 18:50:30 snort[58996]: Not Using PCAP_FRAMES
                                          May 31 18:50:30 snort[58996]: Not Using PCAP_FRAMES
                                          May 31 18:50:30 snort[58996]: Snort initialization completed successfully (pid=58996)
                                          May 31 18:50:30 snort[58996]: Snort initialization completed successfully (pid=58996)

                                          Much appreciated James, thank you for your work and service to the community.

                                          1.2.3-RC1
                                          built on Tue May 26 15:14:15 EDT 2009
                                          FreeBSD 7.2-RELEASE i386

                                          2 Gigs RAM
                                          Processors  2
                                          Model Genuine Intel(R) CPU 2160 @ 1.80GHz
                                          CPU Speed 1.8 GHz
                                          PCI Devices

                                          • atapci0: Intel ICH5 SATA150 controller
                                          • ehci0: Intel 82801EB/R (ICH5) USB 2.0 controller
                                          • fxp0: Intel 82559ER Pro/100 Ethernet
                                          • fxp1: Intel 82559ER Pro/100 Ethernet
                                          • fxp2: Intel 82559ER Pro/100 Ethernet
                                          • isab0: PCI-ISA bridge
                                          • pcib1: ACPI PCI-PCI bridge
                                          • uhci0: Intel 82801EB (ICH5) USB controller USB-A
                                          • uhci1: Intel 82801EB (ICH5) USB controller USB-B
                                          • uhci2: Intel 82801EB (ICH5) USB controller USB-C
                                          • uhci3: Intel 82801EB (ICH5) USB controller USB-D
                                          • vgapci0: VGA-compatible display
                                            IDE Devices
                                          • acd0: ASUS DVD-E616A3T/1.01
                                          • ad0: WDC WD400JD-22MSA1 10.01E01 (Capacity: 39.10 GB)
                                            SCSI Devices none
                                            USB Devices none

                                          AhnHEL (Angel)

                                          1 Reply Last reply Reply Quote 0
                                          • J Offline
                                            jamesdean
                                            last edited by

                                            Thanx onhel.

                                            I need more user sytem info. Hope the community helps out.

                                            Please post pfsense version and system specs.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.