Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort Update and Oinkmaster.conf

    Scheduled Pinned Locked Moved pfSense Packages
    29 Posts 5 Posters 17.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J Offline
      jamesdean
      last edited by

      @jerrygoldsmith:

      @jamesdean:

      Can you you post your system spec and pfsense version.
      thanx

      Thank ya sir!

      1.2.3-RC2 built on Fri Jun 5 01:10:29 EDT 2009
      FreeBSD 7.1-RELEASE-p5 i386
      snapshot from http://snapshots.pfsense.org/FreeBSD_RELENG_7_1/pfSense_RELENG_1_2/updates/pfSense-Full-Update-1.2.3-20090605-0110.tgz

      processor-   VIA Samuel 2 (800mhz)
      RAM   -   512mb pc133

      Its an IP3 Gateway (series 100) that I modded and loaded PFsense on about 3 months ago.   I've never had problem with it before, Snort has worked perfectly until this last week.    Also, I've made no signifigant system changes aside from the snapshot version I updated yesterday because I thought that might help (I had run out of ideas and had some time on my hands)

      Thank you in advance for your input.  I've seen you've been working on this a lot lately!

      No Problem, Thanx for the feed back.

      Your system specs are low. I still need to ajust my code for you type of system.
      In a few hours I'll upload code to reduce system resouces for users with your system specs.
      Dont say sir to, you make me feel old. ;)

      thanx
      james

      1 Reply Last reply Reply Quote 0
      • J Offline
        jerrygoldsmith
        last edited by

        @jamesdean:

        No Problem, Thanx for the feed back.

        Your system specs are low. I still need to ajust my code for you type of system.
        In a few hours I'll upload code to reduce system resouces for users with your system specs.
        Dont say sir to, you make me feel old. ;)

        thanx
        james

        Actually, I only use a few rule sets and its worked wonderfully for the past 3 months, maybe 4.  So I'm not sure the specs would be the problem unless there has been a major change in code?  I thought perhaps there were some remnant files left over, and that is what was causing it to hang.  But if you think its the code I'll just wait.

        I should have included this before, but my box only uses about 40%-50% memory usage and 30-40% CPU usage.  I use AC-sparcebands (the others usually don't let Snort start)
        I have the following things running
        SSH (I'm always tunneled in, I travel for work)
        Radius (sometimes on, usually not)
        VN stat

        As for 'Sir', its a work habit.  I call them 'Sir' by default so I don't accidentally call them the names I use for them in my head….. :p

        Thanks again.

        1 Reply Last reply Reply Quote 0
        • J Offline
          jamesdean
          last edited by

          Hey jerrygoldsmith

          You should try "ac-bnfa" its the best setting.
          Hope to finnish coding some time ealy this morning.

          james

          1 Reply Last reply Reply Quote 0
          • J Offline
            jerrygoldsmith
            last edited by

            No rush dude.  I'm off work for 2 weeks so I'm just geeking out on some projects.  Thanks again for your help.

            1 Reply Last reply Reply Quote 0
            • S Offline
              serialdie
              last edited by

              James,

              This the same problem I had with the "extracting rules"… I am using lowmem... I am going to try your suggestion... I am also interested in your new code it might help me as well with my setup...

              TIA!

              1 Reply Last reply Reply Quote 0
              • J Offline
                jamesdean
                last edited by

                New code going up in 10 min.

                Added or fixed:

                Hopefully improved rule extraction.

                Advanced Shared Obect Rules from private companies.

                Fixed old snort double start error. Snort should start faster.

                ToDo:

                Backup rules option (finished coding, testing). (so after reinstalls no more downloading.)
                www.emergingthreats.net rules will be added.
                New RSS tab.

                1 Reply Last reply Reply Quote 0
                • S Offline
                  serialdie
                  last edited by

                  Reinstelld Snort 2.4.8.1 v1.0
                  Rules updates went grate but I still get this error:

                  snort[20732]: FATAL ERROR: Unable to open rules file: ../rules/local.rules or /usr/local/etc/snort/../rules/local.rules

                  Which require a restart from the system to get fix…

                  1 Reply Last reply Reply Quote 0
                  • S Offline
                    serialdie
                    last edited by

                    This time the system is not blocking anything on the alerts tab…

                    IE:

                    06/07-10:00:27.491182 [ ** ] [ 1:1394:10 ] SHELLCODE x86 inc ecx NOOP [ ** ] [ Classification: Executable code was detected ] [ Priority: 1 ] {TCP} 76.13.220.11:80 -> MY IP:36482
                    06/07-10:00:29.492106 [ ** ] [ 1:1394:10 ] SHELLCODE x86 inc ecx NOOP [ ** ] [ Classification: Executable code was detected ] [ Priority: 1 ] {TCP} 76.13.220.11:80 -> MY IP:26976
                    06/07-10:01:03.507222 [ ** ] [ 1:1394:10 ] SHELLCODE x86 inc ecx NOOP [ ** ] [ Classification: Executable code was detected ] [ Priority: 1 ] {TCP} 76.13.218.11:80 -> MY IP:19943

                    The IP

                    76.13.218.11

                    Is not being blocked

                    Ok is official Is not blocking for me at all…

                    
There are currently no items being blocked by snort.

                    Anybody else having the same problem?

                    Update: changed to lowmem and now it blocks some of the IP's but not all.

                    1 Reply Last reply Reply Quote 0
                    • J Offline
                      jamesdean
                      last edited by

                      serialdie

                      The go to www.grc.com and use "shelds up" to test your firewall.
                      do a port scan there.

                      james

                      1 Reply Last reply Reply Quote 0
                      • S Offline
                        serialdie
                        last edited by

                        James,

                        Thank you for your reply. I did the port scan and it came back stealth and snort catch the IP and blocked it….
                        Funny part is when I am doing the test and I get different IP's doing the same exploit it only blocks one IP and not the other IP.

                        Update: here is an example:

                        06/07-10:10:17.526632 [ ** ] [ 1:1394:10 ] SHELLCODE x86 inc ecx NOOP [ ** ] [ Classification: Executable code was detected ] [ Priority: 1 ] {TCP} 76.13.212.11:80 -> MY IP:41951
                        06/07-10:22:28.385658 [ ** ] [ 1:1394:10 ] SHELLCODE x86 inc ecx NOOP [ ** ] [ Classification: Executable code was detected ] [ Priority: 1 ] {TCP} 74.6.104.11:80 -> MY IP:14127

                        In this case IP 74.6.104.11 was blocked but IP 76.13.212.11 was not blocked.

                        1 Reply Last reply Reply Quote 0
                        • J Offline
                          jamesdean
                          last edited by

                          Forgot to mentiion, after reboots.
                          You need to start snort again from the settings tab. (click the save)
                          This is because snort wont start snort2c after reboots. (snort2c is the app the bloacks alerts.)
                          Snort2c not starting after reboots has been in snort package as long as I can remember.

                          Im glad that the snort updates finnished.

                          This error meand that your system for somereson isnt seeing the new files.
                          Going to add a "rehash" after installs hopfully that will fix issue.
                          "snort[20732]: FATAL ERROR: Unable to open rules file: ../rules/local.rules or /usr/local/etc/snort/../rules/local.rules"

                          James

                          1 Reply Last reply Reply Quote 0
                          • S Offline
                            serialdie
                            last edited by

                            James,

                            Thank you for the fast reply. Blocking is now working.
                            Thank you for your hard work!

                            1 Reply Last reply Reply Quote 0
                            • J Offline
                              jerrygoldsmith
                              last edited by

                              Sweeeeet…..

                              Its working, though my services list shows it as stopped even though its actively logging/blocking.    Now I just have to fix my syslog (update of snapshot probably) so I can get a more detailed look at my Snort logs.

                              But since its up and blocking I think that means its 100% :D     And mine has always started after reboot.  Just tested it, and it started automatically after reboot as its logging/blocking, though it shows as stopped in the Services tab and won't start there.   But as its working I'll leave it alone!

                              Thanks man, you rock.   And roll.   All night long.

                              edit
                              with no traffic
                              CPU usage - 29%
                              Memory usage - 34%
                              Not bad.   Slight usage drop after switching to the different memory usage, might be able to fit in a few more rule sets…...

                              1 Reply Last reply Reply Quote 0
                              • J Offline
                                jamesdean
                                last edited by

                                Glad to see you guys with low system specs are running snort package.

                                Snort2c starting for some of us and not starting for some of us might be realted to system memory.
                                Im going to add more memory to my system and see if it helps.

                                James

                                1 Reply Last reply Reply Quote 0
                                • S Offline
                                  serialdie
                                  last edited by

                                  Ok now after I get more than one block in the Blocked tab the system CPU shoots off the roof rendering the system almost unusable.
                                  It was not doing that in the previous pkg…. Any idea whats going?

                                  Edit:

                                  Top shows that php is whats driving the cpu load crazy... and it only does it when I go to the blocked tab..
                                  Any ideas?

                                  Edit 2:

                                  I let the Blocked Page load and after of 4 Min trying to load it finally did to revel a few IP's blocked... Once the page load it the CPU load went down to the avg of 1% to 5%.... It looks like something is not right...

                                  1 Reply Last reply Reply Quote 0
                                  • J Offline
                                    jamesdean
                                    last edited by

                                    @serialdie:

                                    Ok now after I get more than one block in the Blocked tab the system CPU shoots off the roof rendering the system almost unusable.
                                    It was not doing that in the previous pkg…. Any idea whats going?

                                    Edit:

                                    Top shows that php is whats driving the cpu load crazy... and it only does it when I go to the blocked tab..
                                    Any ideas?

                                    Edit 2:

                                    I let the Blocked Page load and after of 4 Min trying to load it finally did to revel a few IP's blocked... Once the page load it the CPU load went down to the avg of 1% to 5%.... It looks like something is not right...

                                    I have not touched any code related to the blocked tab. I have tryed to reproduce the error but every thing looks fine.
                                    At most my system uses 3% when I click on the block tab. (I'm using firefox.)
                                    Holy crap, just used IE8 on the pfsense gui, the gui responds 4x faster. wow.

                                    What web browser are you using ?

                                    james

                                    1 Reply Last reply Reply Quote 0
                                    • S Offline
                                      serialdie
                                      last edited by

                                      I try all of them and they do the same thing… Opera, Firefox, IE, Konqueror, Safari, etc....

                                      Should I reinstall?

                                      1 Reply Last reply Reply Quote 0
                                      • J Offline
                                        jamesdean
                                        last edited by

                                        No dont reinstall, your killing your flash card.

                                        I suspect all your problems are related to you hardware specs.
                                        When I get the board you mailed me I'll install pfsense on there.
                                        I should start to see the same gliches. Then I'll be able to fix the hickups asap.

                                        Just run snort as is for now. Don't worry I'll get to the bottom of this.
                                        Also, Im still adding features, so dont reinstall for a while.

                                        james

                                        1 Reply Last reply Reply Quote 0
                                        • S Offline
                                          serialdie
                                          last edited by

                                          Got it James.

                                          Thank You very much!

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.