Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort problem

    Scheduled Pinned Locked Moved pfSense Packages
    104 Posts 21 Posters 48.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S Offline
      serialdie
      last edited by

      jamesdean,

      HAHAHAHA Nice!!!
      Any info on the new update?
      I am waiting on the PM so I can send you the board as promise.

      Thank You!

      1 Reply Last reply Reply Quote 0
      • S Offline
        serialdie
        last edited by

        James,

        Is
        snort-2.8.4.1 the latest pkg you build?

        Thats the pkg I am getting when I go under System: Package Manager: Install Package: Reinstall Package

        1 Reply Last reply Reply Quote 0
        • S Offline
          serialdie
          last edited by

          Ok thanks…

          Right now I am not able to start Snort at all after the update... Since the update is broken it does not want to start....

          By the way enjoy your new board. Ailx Boards are awesome and they get the job done. Hopefully it fits well for your snort coding.

          1 Reply Last reply Reply Quote 0
          • S Offline
            serialdie
            last edited by

            As non subscriber I get:

            The downloaded file does not match the md5 file…

            Error md5 Mismatch...

            1 Reply Last reply Reply Quote 0
            • S Offline
              serialdie
              last edited by

              Yes.
              I reply.

              Please check your PM

              1 Reply Last reply Reply Quote 0
              • S Offline
                serialdie
                last edited by

                James,

                Any updates? :)

                1 Reply Last reply Reply Quote 0
                • S Offline
                  serialdie
                  last edited by

                  SWWWWEEETTT!!!!  ;D ;D ;D 8) 8) 8)
                  I am glad that I was of help!
                  I am so anxious for this update I am not even sleepy!
                  Man and I have to be at work @ 4AM LOL

                  1 Reply Last reply Reply Quote 0
                  • J Offline
                    jamesdean
                    last edited by

                    Thanx for your help imagine if I had to do this by guessing urls.
                    Get some sleep every time I change something I have to wait 15 min.

                    No worries…

                    Patience it code will be up.

                    Update, code changes work.
                    Finnal step is to make shure nothing gets broken.

                    1 Reply Last reply Reply Quote 0
                    • S Offline
                      serialdie
                      last edited by

                      @jamesdean:

                      Update, code changes work.
                      Finnal step is to make shure nothing gets broken.

                      Cool!

                      1 Reply Last reply Reply Quote 0
                      • S Offline
                        serialdie
                        last edited by

                        James,

                        I got you PM's… If there anything I can do to help please let me know!

                        1 Reply Last reply Reply Quote 0
                        • S Offline
                          serialdie
                          last edited by

                          Update:

                          I just re install the package and as a premium user I was able to update with no problems… Is right now extracting the files.

                          Update:

                          I still have the issue where it hangs when copying the signatures. Looks like the pkg got reverted to the previous one?
                          After a reboot the snorts starts ok and starts working again. :)

                          1 Reply Last reply Reply Quote 0
                          • S Offline
                            serialdie
                            last edited by

                            As requested here is my system info.

                            ALIX.2C3 System Board with

                            • 500 MHz AMD Geode LX800 CPU
                            • 3 10/100 Ethernet ports (VIA VT6105M 10/100)
                            • 1 miniPCI slot for future expansion (VPN Acceleration, wireless, etc.)
                            • 2 USB ports
                            • 256 MB DDR DRAM
                              4GB Microdrive with pfSense 1.2.3-RC1
                              802.11a/b/g WLM54SAG mPCI card, 2 cables & 2 dual band antenna
                            1 Reply Last reply Reply Quote 0
                            • J Offline
                              jamesdean
                              last edited by

                              @serialdie:

                              As requested here is my system info.

                              ALIX.2C3 System Board with

                              • 500 MHz AMD Geode LX800 CPU
                              • 3 10/100 Ethernet ports (VIA VT6105M 10/100)
                              • 1 miniPCI slot for future expansion (VPN Acceleration, wireless, etc.)
                              • 2 USB ports
                              • 256 MB DDR DRAM
                                4GB Microdrive with pfSense 1.2.3-RC1
                                802.11a/b/g WLM54SAG mPCI card, 2 cables & 2 dual band antenna

                              I reinstalled the package today to make shure every thing works. Nothing hung or failed.
                              The script is copying 15000 files so its going to take some time on your system spec.
                              Im going to try a "move" instead of a "copy" to reduce system load. If a move does not reduce the system load, Im going to make an option of the "signatures description files".

                              Though I need those signature description files to be installed so I can add a tab that looks up the discription of alerts.

                              Thanks without your help I would never be able to resove thses final hang ups.

                              Dont try to install the package again im still adding features and I dont want to kill your flash card.

                              1 Reply Last reply Reply Quote 0
                              • S Offline
                                serialdie
                                last edited by

                                Got it!

                                Thank you very much for all your effort and help!

                                1 Reply Last reply Reply Quote 0
                                • J Offline
                                  jigpe
                                  last edited by

                                  Good morning guys :)
                                  Im not good on cli commands… I jus downloaded the snort rules.. How to extract them on the pfsense snort?

                                  jigpd
                                  Davao City
                                  1.2.2

                                  1 Reply Last reply Reply Quote 0
                                  • C Offline
                                    cmb
                                    last edited by

                                    jigpe: They extract automatically after you update the rules.

                                    1 Reply Last reply Reply Quote 0
                                    • J Offline
                                      jigpe
                                      last edited by

                                      Updating the rules took like 9 hours 1st attempt, 2nd attempt was 7 hours and 3rd attempt to 3rd box is worst 11.5 more or less :( (speed 2mb up/dl). But at least it works now. Thanks :)

                                      jigp

                                      1 Reply Last reply Reply Quote 0
                                      • C Offline
                                        ColdFusion
                                        last edited by

                                        That's odd. I have 2 boxes and a 15/2 connection and can download and extract in under 10 minutes usually.

                                        1 Reply Last reply Reply Quote 0
                                        • J Offline
                                          jamesdean
                                          last edited by

                                          jigpe and ColdFusion

                                          The downloading of rules should only take at most 5 min, there's something wrong.

                                          Questions ?

                                          What version of snort package are you using (snort or snort-dev) ?

                                          What are you system spec's ?

                                          Are you using traffic shaper ?

                                          James

                                          1 Reply Last reply Reply Quote 0
                                          • C Offline
                                            ColdFusion
                                            last edited by

                                            Mine downloads in under 1-2 minutes….and I generally hit Save after that....so many 5 minutes or so or less. I just threw out 10 minutes because the OP said his took hours....Basically, I don't have a problem.

                                            Oh, Nice work BTW.....

                                            Ok to answer you question...2 machines:

                                            C3 via 600MHZ 1 gig ram Snort DEV traffic shaping yes
                                            Semprom 3800 2 gig ram Snort DEV traffic shaping yes

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.