Snort, problem with startup services

jamesdean

After fresh install PF 1.2.3 with snort beta (or normal), i can t started the service. What could be the problem?

I have P4 2.8MHz, 3GB ram,… before it works OK,... only the difference is, new rules/category.

How can i add more memory to snort? Do i need any change to done in config file?

Thanks for your support

LOG FILE:

Dec 26 07:39:08 SnortStartup[62064]: MEM after 0em1 START 63M
Dec 26 07:39:08 SnortStartup[62059]: Snort HARD Reload For 0em1…
Dec 26 07:39:08 syslogd: kernel boot file is /boot/kernel/kernel
Dec 26 07:38:44 syslogd: kernel boot file is /boot/kernel/kernel
Dec 26 07:38:44 syslogd: exiting on signal 15
Dec 26 07:37:34 SnortStartup[61568]: MEM after 0em1 START 62M
Dec 26 07:37:34 SnortStartup[61563]: Snort HARD Reload For 0em1…
Dec 26 07:37:34 syslogd: kernel boot file is /boot/kernel/kernel
Dec 26 07:36:39 SnortStartup[60939]: MEM after 0em1 START 63M
Dec 26 07:36:39 SnortStartup[60934]: Snort HARD Reload For 0em1…

Try to start the serves manually and post the error.

simby

Is this ok? :)

Thanks for helping me James

–== Initializing Snort ==--
Initializing Output Plugins!
Initializing Preprocessors!
Initializing Plug-ins!
Parsing Rules file /usr/local/etc/snort/snort.conf
PortVar 'HTTP_PORTS' defined : [ 80 2301 3128 7777 7779 8000 8008 8028 8080 8180 8888 9999 ]
PortVar 'SHELLCODE_PORTS' defined : [ any ]
PortVar 'ORACLE_PORTS' defined : [ 1024:65535 ]
PortVar 'AUTH_PORTS' defined : [ 113 ]
PortVar 'DNS_PORTS' defined : [ 53 ]
PortVar 'FINGER_PORTS' defined : [ 79 ]
PortVar 'FTP_PORTS' defined : [ 21 ]
PortVar 'IMAP_PORTS' defined : [ 143 ]
PortVar 'IRC_PORTS' defined : [ 6665:6669 7000 ]
PortVar 'MSSQL_PORTS' defined : [ 1433 ]
PortVar 'NNTP_PORTS' defined : [ 119 ]
PortVar 'POP2_PORTS' defined : [ 109 ]
PortVar 'POP3_PORTS' defined : [ 110 ]
PortVar 'SUNRPC_PORTS' defined : [ 111 32770:32779 ]
PortVar 'RLOGIN_PORTS' defined : [ 513 ]
PortVar 'RSH_PORTS' defined : [ 514 ]
PortVar 'SMB_PORTS' defined : [ 139 445 ]
PortVar 'SMTP_PORTS' defined : [ 25 ]
PortVar 'SNMP_PORTS' defined : [ 161 ]
PortVar 'SSH_PORTS' defined : [ 22 ]
PortVar 'TELNET_PORTS' defined : [ 23 ]
PortVar 'MAIL_PORTS' defined : [ 25 143 465 691 ]
PortVar 'SSL_PORTS' defined : [ 25 443 465 636 993 995 ]
PortVar 'DCERPC_NCACN_IP_TCP' defined : [ 139 445 ]
PortVar 'DCERPC_NCADG_IP_UDP' defined : [ 138 1024:65535 ]
PortVar 'DCERPC_NCACN_IP_LONG' defined : [ 135 139 445 593 1024:65535 ]
PortVar 'DCERPC_NCACN_UDP_LONG' defined : [ 135 1024:65535 ]
PortVar 'DCERPC_NCACN_UDP_SHORT' defined : [ 135 593 1024:65535 ]
PortVar 'DCERPC_NCACN_TCP' defined : [ 2103 2105 2107 ]
PortVar 'DCERPC_BRIGHTSTORE' defined : [ 6503:6504 ]
Detection:
Search-Method = AC-BNFA-Q
Frag3 global config:
Max frags: 65536
Fragment memory cap: 4194304 bytes
Frag3 engine config:
Target-based policy: WINDOWS
Fragment timeout: 180 seconds
Fragment min_ttl: 1
Fragment ttl_limit (not used): 5
Fragment Problems: 0
Stream5 global config:
Track TCP sessions: ACTIVE
Max TCP sessions: 8192
Memcap (for reassembly packet storage): 8388608
Track UDP sessions: ACTIVE
Max UDP sessions: 131072
Track ICMP sessions: INACTIVE
Log info if session memory consumption exceeds 1048576
Stream5 TCP Policy config:
Reassembly Policy: WINDOWS
Timeout: 30 seconds
Min ttl: 1
Maximum number of bytes to queue per session: 1048576
Maximum number of segs to queue per session: 2621
Options:
Static Flushpoint Sizes: YES
Reassembly Ports:
21 client (Footprint)
22 client (Footprint)
23 client (Footprint)
25 client (Footprint)
42 client (Footprint)
53 client (Footprint)
79 client (Footprint)
80 client (Footprint)
109 client (Footprint)
110 client (Footprint)
111 client (Footprint)
113 client (Footprint)
119 client (Footprint)
135 client (Footprint)
136 client (Footprint)
137 client (Footprint)
139 client (Footprint)
143 client (Footprint)
161 client (Footprint)
443 client (Footprint) server (Footprint)
Stream5 UDP Policy config:
Timeout: 30 seconds
Options:
Ignore Any -> Any Rules: YES
HttpInspect Config:
GLOBAL CONFIG
Max Pipeline Requests: 0
Inspection Type: STATELESS
Detect Proxy Usage: NO
IIS Unicode Map Filename: /usr/local/etc/snort/unicode.map
IIS Unicode Map Codepage: 1252
DEFAULT SERVER CONFIG:
Server profile: All
Ports: 80 2301 3128 7777 7779 8000 8008 8028 8080 8180 8888 9999
Server Flow Depth: 1460
Client Flow Depth: 300
Max Chunk Length: 500000
Max Header Field Length: 0
Max Number Header Fields: 0
Inspect Pipeline Requests: YES
URI Discovery Strict Mode: NO
Allow Proxy Usage: NO
Disable Alerting: NO
Oversize Dir Length: 500
Only inspect URI: NO
Normalize HTTP Headers: NO
Normalize HTTP Cookies: NO
Ascii: YES alert: NO
Double Decoding: YES alert: NO
%U Encoding: YES alert: YES
Bare Byte: YES alert: NO
Base36: OFF
UTF 8: YES alert: NO
IIS Unicode: YES alert: NO
Multiple Slash: YES alert: NO
IIS Backslash: YES alert: NO
Directory Traversal: YES alert: NO
Web Root Traversal: YES alert: NO
Apache WhiteSpace: YES alert: NO
IIS Delimiter: YES alert: NO
IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG
Non-RFC Compliant Characters: 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07
Whitespace Characters: 0x09 0x0b 0x0c 0x0d
rpc_decode arguments:
Ports to decode RPC on: 111 32770 32771 32772 32773 32774 32775 32776 32777 32778 32779
alert_fragments: INACTIVE
alert_large_fragments: ACTIVE
alert_incomplete: ACTIVE
alert_multiple_requests: ACTIVE
ERROR: Unable to open rules file: ../rules/local.rules or /usr/local/etc/snort/../rules/local.rules
Fatal Error, Quitting..

jamesdean

simby

Sorry, this all my fault.

There is a bug in snort-dev, rule files are not being copied over after updates.
Rules are only being copied after interface creation.

Fix

Manually copy "cp /usr/local/etc/snort/rules* /usr/local/etc/snort/snort_myinterface/rules

or

Delete all your interfaces.
Update your rules.
Create your interfaces.

Merry Christmas
James

simby

Thanks, fixed now. Do i need to do this on every update of snort rules?

simby

now i have this problem:

Loading dynamic engine /usr/local/lib/snort_dynamicengine/libsf_engine.so… ERROR: Failed to load /usr/local/lib/snort_dynamicengine/libsf_engine.so: Cannot open "/usr/local/lib/snort_dynamicengine/libsf_engine.so"
Fatal Error, Quitting..

jamesdean

@simby:

now i have this problem:

Loading dynamic engine /usr/local/lib/snort_dynamicengine/libsf_engine.so… ERROR: Failed to load /usr/local/lib/snort_dynamicengine/libsf_engine.so: Cannot open "/usr/local/lib/snort_dynamicengine/libsf_engine.so"
Fatal Error, Quitting..

Reinstall the snort-dev package I added code today.

Fallow my changes at https://rcs.pfsense.org/users/robiscool

James

simby

Thanks!!! & for link :)

ToxIcon

pfsense 1.2.3-RELEASE
snort-dev 2.8.4.1_7 pkg v. 1.8

short Rules tab error:
please work Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/snort/snort_rules.php:390) in /usr/local/www/guiconfig.inc on line 35 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/snort/snort_rules.php:390) in /usr/local/www/guiconfig.inc on line 36 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/snort/snort_rules.php:390) in /usr/local/www/guiconfig.inc on line 37 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/snort/snort_rules.php:390) in /usr/local/www/guiconfig.inc on line 38 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/snort/snort_rules.php:390) in /usr/local/www/guiconfig.inc on line 39

cant save/apply enable new rules

snort to dashboard gives 404 - Not Found

jamesdean

@ToxIcon:

pfsense 1.2.3-RELEASE
snort-dev 2.8.4.1_7 pkg v. 1.8

short Rules tab error:
please work Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/snort/snort_rules.php:390) in /usr/local/www/guiconfig.inc on line 35 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/snort/snort_rules.php:390) in /usr/local/www/guiconfig.inc on line 36 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/snort/snort_rules.php:390) in /usr/local/www/guiconfig.inc on line 37 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/snort/snort_rules.php:390) in /usr/local/www/guiconfig.inc on line 38 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/snort/snort_rules.php:390) in /usr/local/www/guiconfig.inc on line 39

cant save/apply enable new rules

snort to dashboard gives 404 - Not Found

Updated code…...
Am all done with snort_blocked.php and snort_alerts.php.

snort_rules.php is to slow.

Im adding code to make it faster.

James

simby

On alerts blocked we have this error:

Warning: array_unique(): The argument should be an array in /usr/local/www/snort/snort_blocked.php on line 345 Warning: Invalid argument supplied for foreach() in /usr/local/www/snort/snort_blocked.php on line 350 ;)

jamesdean

I have just tested and the code works.

Do you have the latest code ?

Do you have alerts that are not blocked ?

James

simby

Yes, i have the last code from today,… i will add you later picture.

simby

Picture,… can you please fix this log reporting to fix the new theme :)

snapshot1.png_thumb

snapshot2.png_thumb

jamesdean

@simby:

Picture,… can you please fix this log reporting to fix the new theme :)

Updated code to deal with corrupted alerts file, said error should be fixed now.

Now Im working on snort_rules.php trying to make it faster.

James

ToxIcon

snort-dev 2.8.4.1_7 pkg v. 1.8

PROTO:255 (portscan) UDP Filtered Portsweep Prep x.x.x.x empty -> x.x.x.x empty 122:23:0 01/03-16:46:06

what snort rule triggers the alert above