Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort problem

    Scheduled Pinned Locked Moved pfSense Packages
    104 Posts 21 Posters 48.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • ? This user is from outside of this forum
      Guest
      last edited by

      First of all I would like to say Thank you and an excellent job well done.  As of right now i think snort is down so i couldn't get my oink code so i can't test the update.  But snort working great.

      May 31 18:16:21 shinigami snort[14439]: [ Port Based Pattern Matching Memory ]
May 31 18:16:21 shinigami snort[14439]: [ Port Based Pattern Matching Memory ]
May 31 18:16:21 shinigami snort[14439]: +-[AC-BNFA Search Info Summary]------------------------------
May 31 18:16:21 shinigami snort[14439]: +-[AC-BNFA Search Info Summary]------------------------------
May 31 18:16:21 shinigami snort[14439]: | Instances        : 655
May 31 18:16:21 shinigami snort[14439]: | Instances        : 655
May 31 18:16:21 shinigami snort[14439]: | Patterns         : 111013
May 31 18:16:21 shinigami snort[14439]: | Patterns         : 111013
May 31 18:16:21 shinigami snort[14439]: | Pattern Chars    : 1088067
May 31 18:16:21 shinigami snort[14439]: | Pattern Chars    : 1088067
May 31 18:16:21 shinigami snort[14439]: | Num States       : 801960
May 31 18:16:21 shinigami snort[14439]: | Num States       : 801960
May 31 18:16:21 shinigami snort[14439]: | Num Match States : 148254
May 31 18:16:21 shinigami snort[14439]: | Num Match States : 148254
May 31 18:16:21 shinigami snort[14439]: | Memory           :   20.44Mbytes
May 31 18:16:21 shinigami snort[14439]: | Memory           :   20.44Mbytes
May 31 18:16:21 shinigami snort[14439]: |   Patterns       :   3.58M
May 31 18:16:21 shinigami snort[14439]: |   Patterns       :   3.58M
May 31 18:16:21 shinigami snort[14439]: |   Match Lists    :   6.99M
May 31 18:16:21 shinigami snort[14439]: |   Match Lists    :   6.99M
May 31 18:16:21 shinigami snort[14439]: |   Transitions    :   9.71M
May 31 18:16:21 shinigami snort[14439]: |   Transitions    :   9.71M
May 31 18:16:21 shinigami snort[14439]: +-------------------------------------------------
May 31 18:16:21 shinigami snort[14439]: +-------------------------------------------------
May 31 18:16:21 shinigami snort[14439]: Snort initialization completed successfully (pid=14439)
May 31 18:16:21 shinigami snort[14439]: Snort initialization completed successfully (pid=14439)
May 31 18:16:21 shinigami snort[14439]: Not Using PCAP_FRAMES
May 31 18:16:21 shinigami snort[14439]: Not Using PCAP_FRAMES

      I will ilet you know once i get my oink code.  Thanks again for your hard work and you are certainly highly appreciated.

      1 Reply Last reply Reply Quote 0
      • T Offline
        try
        last edited by

        THanks to Jamesdean snort working again in my pfSense running

        pfSense 1.2.2
        built on Thu Jan 8 22:39:31 EST 2009
        FreeBSD 7.0-RELEASE-p8 i386

        rules update in progress..

        I'll let you know when the update finished.

        edit:
        yes, the rules update also work, Snort says:
        Your rules are up to date…

        Cheers,

        1 Reply Last reply Reply Quote 0
        • J Offline
          jamesdean
          last edited by

          Man oh man.

          Snort.org changed the way there files are downloaded. Third night in a row….
          The md5 file downloads but is emty. This is there way to enforce the 15 min wait for updates.

          thanx
          james

          1 Reply Last reply Reply Quote 0
          • H Offline
            Hugovsky
            last edited by

            2 boxes:

            1-1.2.3-RC1
            built on Sat May 30 22:26:25 EDT 2009.
            snort package v.2.8.4
            Doing ppoe with bridged router. Can't update rules and everytime ip changes, snort won't restart. Restart snort mannualy to work.

            2-1.2.3-RC1
            built on Tue May 12 00:32:03 EDT 2009
            snort package v.2.8.4
            behind router. working like a charm.
            Can't update rules.

            Your work IS GREATLY apreciatted by me. It's because of people like you that I learn something every day. I just hope some day I could do something to help the community, just like you.

            BIG thanks for your work.

            1 Reply Last reply Reply Quote 0
            • S Offline
              serialdie
              last edited by

              James,

              Do you have a pay pal link?
              I wont mind sending you a donation for all your work!!!

              Thanks!

              1 Reply Last reply Reply Quote 0
              • J Offline
                jamesdean
                last edited by

                Thanx serialdie, Hugovsky. Your type of peple I'm doing this for. Send mony to the pfsense core developers so they can buy me a mini-itx.

                –------------------------------
                Added today

                Updates work again.
                "when did I last download, time stamps info" (just started)

                Adding latter today. If I have time.

                Rules backup option. you will need 180 megs for this.
                Alerts to system log. (Requested don't know why.)
                Identify snort package version.
                redo Update rules automatically option.
                RSS feeds.

                If there is any one here in the forums that is a Premium snort rules user, Please email me.

                james

                1 Reply Last reply Reply Quote 0
                • L Offline
                  lordarcane
                  last edited by

                  Hey!

                  Snort up and running again.

                  Running pfsense 1.2.2

                  ReInstalled snort package, downloaded the rules.
                  Had to save the rules before I could start snort, otherwise it said unable to load the rules.

                  Thanks for all the hard work!

                  1 Reply Last reply Reply Quote 0
                  • H Offline
                    Hugovsky
                    last edited by

                    James, you're the man….

                    1 Reply Last reply Reply Quote 0
                    • S Offline
                      serialdie
                      last edited by

                      @jamesdean:

                      Thanx serialdie, Hugovsky. Your type of peple I'm doing this for. Send mony to the pfsense core developers so they can buy me a mini-itx.

                      –------------------------------
                      Added today

                      Updates work again.
                      "when did I last download, time stamps info" (just started)

                      Adding latter today. If I have time.

                      Rules backup option. you will need 180 megs for this.
                      Alerts to system log. (Requested don't know why.)
                      RSS feeds.

                      If there is any one here in the forums that is a Premium snort rules user, Please email me.

                      james

                      James I am a premium user.

                      I will be emailing you today.

                      1 Reply Last reply Reply Quote 0
                      • S Offline
                        serialdie
                        last edited by

                        James,

                        Please check your pm.

                        Also if you need hardware for development I have no problem getting you an Alix Board… Unless you really need a Mini-ITX than I can look in to the Mini-ITX form factor but I would prefer donating a Brand new Alix board to you. If interested please PM.
                        Somebody else can pitch in the rest of the hardware??

                        Take Care!

                        1 Reply Last reply Reply Quote 0
                        • J Offline
                          jamesdean
                          last edited by

                          I have scripts that maonitor the nytimes, digg and twitter for news i like.
                          This just came up.

                          This is what Im talking about.

                          1 Reply Last reply Reply Quote 0
                          • S Offline
                            serialdie
                            last edited by

                            jamesdean,

                            HAHAHAHA Nice!!!
                            Any info on the new update?
                            I am waiting on the PM so I can send you the board as promise.

                            Thank You!

                            1 Reply Last reply Reply Quote 0
                            • S Offline
                              serialdie
                              last edited by

                              James,

                              Is
                              snort-2.8.4.1 the latest pkg you build?

                              Thats the pkg I am getting when I go under System: Package Manager: Install Package: Reinstall Package

                              1 Reply Last reply Reply Quote 0
                              • S Offline
                                serialdie
                                last edited by

                                Ok thanks…

                                Right now I am not able to start Snort at all after the update... Since the update is broken it does not want to start....

                                By the way enjoy your new board. Ailx Boards are awesome and they get the job done. Hopefully it fits well for your snort coding.

                                1 Reply Last reply Reply Quote 0
                                • S Offline
                                  serialdie
                                  last edited by

                                  As non subscriber I get:

                                  The downloaded file does not match the md5 file…

                                  Error md5 Mismatch...

                                  1 Reply Last reply Reply Quote 0
                                  • S Offline
                                    serialdie
                                    last edited by

                                    Yes.
                                    I reply.

                                    Please check your PM

                                    1 Reply Last reply Reply Quote 0
                                    • S Offline
                                      serialdie
                                      last edited by

                                      James,

                                      Any updates? :)

                                      1 Reply Last reply Reply Quote 0
                                      • S Offline
                                        serialdie
                                        last edited by

                                        SWWWWEEETTT!!!!  ;D ;D ;D 8) 8) 8)
                                        I am glad that I was of help!
                                        I am so anxious for this update I am not even sleepy!
                                        Man and I have to be at work @ 4AM LOL

                                        1 Reply Last reply Reply Quote 0
                                        • J Offline
                                          jamesdean
                                          last edited by

                                          Thanx for your help imagine if I had to do this by guessing urls.
                                          Get some sleep every time I change something I have to wait 15 min.

                                          No worries…

                                          Patience it code will be up.

                                          Update, code changes work.
                                          Finnal step is to make shure nothing gets broken.

                                          1 Reply Last reply Reply Quote 0
                                          • S Offline
                                            serialdie
                                            last edited by

                                            @jamesdean:

                                            Update, code changes work.
                                            Finnal step is to make shure nothing gets broken.

                                            Cool!

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.