Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort-dev has been released. old snort has been renamed snort-old

    Scheduled Pinned Locked Moved pfSense Packages
    50 Posts 20 Posters 18.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T Offline
      tester_02
      last edited by

      Any chance of a workaround for deinstalling the old snort properly.  My pfsense 1.2.3 released died when I uninstalled it and rebooted.  A fresh install was my only way to get it back.  I have a friend who I helped install pfsense on, and I am scared to update snort for him.
        You mentioned that there is a problem with the old snort not properly uninstalling.  Any chance of a script that will properly uninstall, so that we can put the new one on?

      Jamesdean Please keep up the good work.  The new version is working great for me, and all the rules are working.  I think some people forget that there is always a need for someone to keep these packages updated and running, or they stop working as the main authors update their work (snort, squid, etc).

      Hey CDX.  You may not have noticed but the old snort stopped working a few weeks ago with a rules update from snort.org.  You could get it back running, but with many rules disabled.

      1 Reply Last reply Reply Quote 0
      • J Offline
        jamesdean
        last edited by

        tester_02 do me a fav. deinstall snort and then install again.
        I forgot are you on 2.0 ?

        I added code that removes snort-old entries. It should help your deinstall problems.
        If it does not report back here as soon as you can.

        I working out these problem on a pfsense 1.2.3 nanobsd on a CF card
        every thing seems fine.

        James

        1 Reply Last reply Reply Quote 0
        • D Offline
          dnegreira
          last edited by

          Hi,

          I am using PfSense 1.2.3.
          I confirm that the latest snort package version 1.20 is working correctly!

          Thanks a lot for the fix jamesdean and i hope that you can keep up the excellent work ;)

          Kind regards,
          David Negreira.

          1 Reply Last reply Reply Quote 0
          • V Offline
            vito
            last edited by

            Hi JamesDean,
            I have the latest Snort running and i am noticing something.

            i had Snort working fine with one interface up (WAN)
            At one point, i needed to disable Snort….So i disabled Snort on the WAN interface (only interface i configured), but Snort still is/was blocking.
            Snort Service was still started in Services (which it would seem correct since one interface should not stop the whole package)

            I'm i missing a setting or something?

            Thanks for your help
            Also, would you rather new threads on issues or continue this thread?
            Again, thanks for the work on this package!

            PF 1.2.3 Full
            Snort 2.8.5.3 pkg v. 1.19

            1 Reply Last reply Reply Quote 0
            • D Offline
              dnegreira
              last edited by

              Vito,

              Try to install the latest snort package 1.20.

              1 Reply Last reply Reply Quote 0
              • V Offline
                vito
                last edited by

                ok… did that just come out?
                I thought i checked yesterday.

                anyway, just installed....Now all my settings are gone....

                1 Reply Last reply Reply Quote 0
                • V Offline
                  vatson
                  last edited by

                  @dnegreira:

                  Hi,

                  I am using PfSense 1.2.3.
                  I confirm that the latest snort package version 1.20 is working correctly!

                  Does it mean that upgrade from previous Snort package is now possible without full pfSense reinstall?

                  1 Reply Last reply Reply Quote 0
                  • J Offline
                    joukahainen
                    last edited by

                    @vatson:

                    @dnegreira:

                    Hi,

                    I am using PfSense 1.2.3.
                    I confirm that the latest snort package version is working correctly!

                    Does it mean that upgrade from previous Snort package is now possible without full pfSense reinstall?

                    Yes it does mean that.

                    I can also confirm that this release works without full Pfsense reinstall. I was stuck with the old snort installation version untill 1.20 was released.

                    The 1.20 version seems to have some minor bugs left (update rules page only works with Firefox and stays stuck with "please be patient" message eaven when using Firefox after the rule update is finnished, and in my case it took a while before snort started actually blocking those hosts that generate alerts), but these are not big issues in my opinion.

                    1 Reply Last reply Reply Quote 0
                    • T Offline
                      tester_02
                      last edited by

                      Snort 1.20 install went great, no issues  on my 1.2.3.release install. I had no issues on my firefox and getting new rules.

                      Can others comment if they do an upgrade from the old releases (2.8.4 v1.7) that their installs do work?  Also, if you deinstalled, and then installed the new package, or just did a reinstall to upgrade?

                      I have my brothers update to do, and don't want to do a reinstall as he is not local to me and he's completely new to pfsense. :)

                      1 Reply Last reply Reply Quote 0
                      • ? Offline
                        A Former User
                        last edited by

                        @tester_02:

                        Snort 1.20 install went great, no issues  on my 1.2.3.release install. I had no issues on my firefox and getting new rules.

                        Can others comment if they do an upgrade from the old releases (2.8.4 v1.7) that their installs do work?  Also, if you deinstalled, and then installed the new package, or just did a reinstall to upgrade?

                        I have my brothers update to do, and don't want to do a reinstall as he is not local to me and he's completely new to pfsense. :)

                        The best now is after a reboot it uninstalls it's self .great fix that was .

                        1 Reply Last reply Reply Quote 0
                        • J Offline
                          joukahainen
                          last edited by

                          @tester_02:

                          Snort 1.20 install went great, no issues  on my 1.2.3.release install. I had no issues on my firefox and getting new rules.

                          Can others comment if they do an upgrade from the old releases (2.8.4 v1.7) that their installs do work?  Also, if you deinstalled, and then installed the new package, or just did a reinstall to upgrade?

                          In my case (runnig pfsense 1.2.3 and the old snort version was 2.8.4 v1.7). I did deinstall the old version first and then installed the new 1.20 package.  Worked fine that way

                          Just in case for those that are doing upgrade, or new with snort : Also remeber tho check the preprocessors settings when activating new rules. Snort wont start if you activate rules that require for example http preprocessor and the needed preprocessor is not selected (snort logs are good for finding what is wrong).

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.