Snort Problems

[JustinHoMi]

I looked at the code, but things have changed so much since I last messed with the snort package, that it's not going to be worth my effort to screw around with. I'm just downloading the rules manually for now.

[JustinHoMi]

Tried updating the rules manually, and getting this error:

snort[63763]: FATAL ERROR: Dynamic detection lib /usr/local/lib/snort/dynamicrules//lib_sfdynamic_example_rule.so 1.0 isn't compatible with the current dynamic engine library /usr/local/lib/snort/dynamicengine/libsf_engine.so 1.10. The dynamic detection lib is compiled with an older version of the dynamic engine.

Any thoughts? I tried uninstalling/reinstalling, same thing. Might not be related.

Edit: resolved by deleting /usr/local/lib/snort/dynamicrules/lib_sfdynamic_example_rule.so

[warzac]

I have the same probléme. the manuelly upgrade not work and snort don't work normally.
Anybody can help me

[blueknigh7]

@JustinHoMi:

Tried updating the rules manually, and getting this error:

snort[63763]: FATAL ERROR: Dynamic detection lib /usr/local/lib/snort/dynamicrules//lib_sfdynamic_example_rule.so 1.0 isn't compatible with the current dynamic engine library /usr/local/lib/snort/dynamicengine/libsf_engine.so 1.10. The dynamic detection lib is compiled with an older version of the dynamic engine.

Any thoughts? I tried uninstalling/reinstalling, same thing. Might not be related.

Edit: resolved by deleting /usr/local/lib/snort/dynamicrules/lib_sfdynamic_example_rule.so

I have the exact same error.  I did the same thing and renamed/deleted the file.

[A Former User]

:( I tryed the manual update and does not seem to work for me .What happened with snort it worked so well for so long and the last time i stopped using Pfsense was because of this same problem .I have no idea why people have to play with things when they work perfectly .
Has anyone found out the problem yet .Snort still will not update and there is no errors ..

[davidindesignlondon.co.u]

Thanks JustinHoMi,

Worked perfectly! :)

[nufer]

I had the same problem.

solved by changing to basic rules in Global Configuration tab

[0tt0]

@nufer:

I had the same problem.

solved by changing to basic rules in Global Configuration tab

Doesn't premium rules require a subscription? (And NOT just an Oinkcode=registration)

[LostInIgnorance]

With the premium rules, I am noticing I am not able to update them and I keep getting errors of:

Directory so_rules does not exist…

Error copying so_rules...

I use the basic and it updates fine.  I know snort came up with a new program two days ago.

[g4m3c4ck]

Lost: Broke for me too but I manually fixed it in this thread.http://forum.pfsense.org/index.php/topic,24434.15.html

[pneumoboy]

Hello all…

I am running 1.2.3 with snort 2.8.5.3 v1.22 (upgraded two days ago after the so directory error appeared).

I cannot update my rules when I have the "Premium Rules" box check (despite being a snort VRT subscriber). I had to select "Basic Rules" in order to get the updates.

Right now I am not sure I am getting the most recent/up-to-date rules from snort, or if I am getting the 30-day (non-subscriber) rules. I know there are different URLs for the rule snapshots depending on if you are just registered or if you are a subscriber.

I see others are having this problem, but I have not seen a definite fix. Any suggestion?

[pneumoboy]

Good news! Just saw an updated snort package is out. Version 2.8.5.3 pkg v. 1.23 is working with Premium Rules. Not only was I able to download all the rules, but snort started with no errors when I enabled every category (with defaults) on the WAN interface.

Thanks to the pfSense team for an awesome product!