Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort package on 64 doesn't work

    Scheduled Pinned Locked Moved pfSense Packages
    55 Posts 16 Posters 20.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • V
      VeGeTa-X
      last edited by

      yes all options are turned on for preprocessors and did a all port scan on the site below and no alerts.

      1 Reply Last reply Reply Quote 0
      • C
        Cino
        last edited by

        i have no idea ???  It worked for me last weekend… Are your running 2.0RC3 or 2.1-Dev?

        1 Reply Last reply Reply Quote 0
        • V
          VeGeTa-X
          last edited by

          I am running 2.0rc3 64bit

          1 Reply Last reply Reply Quote 0
          • G
            Gloom
            last edited by

            @VeGeTa-X:

            I have one more question when I enable block offenders snort does not work and when I disable it snort works.  I found the link below saying that snort package is missing some kind of spoink code?

            http://redmine.pfsense.org/issues/1753

            spoink is an Open BSD output plugin that adds the offending host to the block list in snort. I was always under the impression that pfsense used snort2c to do that job. Seems I was wrong.

            Never underestimate the power of human stupidity

            1 Reply Last reply Reply Quote 0
            • C
              Cino
              last edited by

              @VeGeTa-X:

              I am running 2.0rc3 64bit

              i'll have to start a vm for 2.0rc3… I tried 2.1 Dev last weekend and it worked for me

              1 Reply Last reply Reply Quote 0
              • I
                Ibor Daru
                last edited by

                @Cino:

                @VeGeTa-X:

                I am running 2.0rc3 64bit

                i'll have to start a vm for 2.0rc3… I tried 2.1 Dev last weekend and it worked for me

                Running 2.0-RC3 (amd64) built on Sat Aug 6 23:18:46 EDT 2011. Checked "Send alerts to main System logs". I'm getting alerts within the Alerts tab as well as the main system logs.

                1 Reply Last reply Reply Quote 0
                • C
                  Cino
                  last edited by

                  @Ibor:

                  @Cino:

                  @VeGeTa-X:

                  I am running 2.0rc3 64bit

                  i'll have to start a vm for 2.0rc3… I tried 2.1 Dev last weekend and it worked for me

                  Running 2.0-RC3 (amd64) built on Sat Aug 6 23:18:46 EDT 2011. Checked "Send alerts to main System logs". I'm getting alerts within the Alerts tab as well as the main system logs.

                  So it is working on 2.0RC3..Good to know

                  1 Reply Last reply Reply Quote 0
                  • A
                    asterix
                    last edited by

                    Can a couple of more folks confirm Snort works on latest amd64 2.0 RC3 snapshots? I tried it on earlier this week and it was not working. Had done clean installs a few times but was never successful to get Snort running. Now on 32-bit 2.0 RC3 as Snort is kinda broken even on 1.2.3 with Snort.org rules not updating. Not a happy camper !!

                    1 Reply Last reply Reply Quote 0
                    • C
                      Cino
                      last edited by

                      @asterix:

                      Can a couple of more folks confirm Snort works on latest amd64 2.0 RC3 snapshots? I tried it on earlier this week and it was not working. Had done clean installs a few times but was never successful to get Snort running. Now on 32-bit 2.0 RC3 as Snort is kinda broken even on 1.2.3 with Snort.org rules not updating. Not a happy camper !!

                      Its works on 2.0RC3 i386… 2 bugs that I know of, Barnyard2 and you can't clear the alerts but you can clear the block list... There are post for a workaround on barnyard2

                      1 Reply Last reply Reply Quote 0
                      • A
                        asterix
                        last edited by

                        amd64?

                        1 Reply Last reply Reply Quote 0
                        • I
                          Ibor Daru
                          last edited by

                          @Cino:

                          @Ibor:

                          @Cino:

                          @VeGeTa-X:

                          I am running 2.0rc3 64bit

                          i'll have to start a vm for 2.0rc3… I tried 2.1 Dev last weekend and it worked for me

                          Running 2.0-RC3 (amd64) built on Sat Aug 6 23:18:46 EDT 2011. Checked "Send alerts to main System logs". I'm getting alerts within the Alerts tab as well as the main system logs.

                          So it is working on 2.0RC3..Good to know

                          BUT only after entering/executing the following code!! Without it, Snort will not work!

                          
ln -s /usr/lib/libpcap.so /usr/lib/libpcap.so.1
                          1 Reply Last reply Reply Quote 0
                          • C
                            Cino
                            last edited by

                            @Ibor:

                            @Cino:

                            @Ibor:

                            @Cino:

                            @VeGeTa-X:

                            I am running 2.0rc3 64bit

                            i'll have to start a vm for 2.0rc3… I tried 2.1 Dev last weekend and it worked for me

                            Running 2.0-RC3 (amd64) built on Sat Aug 6 23:18:46 EDT 2011. Checked "Send alerts to main System logs". I'm getting alerts within the Alerts tab as well as the main system logs.

                            So it is working on 2.0RC3..Good to know

                            BUT only after entering/executing the following code!! Without it, Snort will not work!

                            
ln -s /usr/lib/libpcap.so /usr/lib/libpcap.so.1

                            I wonder if its because of all the packages i have install, maybe one of them ran that command for me…

                            1 Reply Last reply Reply Quote 0
                            • A
                              asterix
                              last edited by

                              So basically snort on amd64 is still broken.

                              1 Reply Last reply Reply Quote 0
                              • C
                                Cino
                                last edited by

                                @asterix:

                                So basically snort on amd64 is still broken.

                                well if it runs after running a command or two, it wouldn't be broken then! Any why not just run i386? Unless your pumping heavy traffic thru the box and need a lot of memory, I see no benefit running AMD64.

                                I hate to say this but if your so bent out of shape for snort, then go install another fw distro and deal with their bloatware instead of whining on every snort thread that its not working. There are tickets opened on the issue and the dev's will get to them when they can. You can always donate money to help push it along if you like.

                                1 Reply Last reply Reply Quote 0
                                • D
                                  dwood
                                  last edited by

                                  Big props to the "C" man on this.  For the first time since starting to experiment with replacing our Draytek boxes/smartmonitor with pfsense, I have a working SNORT (2.8.6.1 pkg v. 2.0)  interface.

                                  Running the command from an SSH shell worked:```
                                  ln -s /usr/lib/libpcap.so /usr/lib/libpcap.so.1

                                  
I'm on a fresh install of 2.0-RC3 (amd64) built on Fri Aug 12 14:47:46 EDT 2011\.  With SNORT running on both WAN interfaces and a pile of rules selectd, The Atom 330@1.6GHz is showing 15 to 20% usage, and the 2GB of RAM is 72% utilized  

So the next step is to get it working so that having "Block Offenders" enabled works.  Right now, the service will not start with that box checked…which in my rookie understanding of SNORT means it's not really doing anything for me yet.  I have two WAN connections, RE1 (DHCP) and RE2 (PPPOE), so would be happy to provide error logs.

With "Block Offenders" checked, the system log returns: snort[37235]: FATAL ERROR: /usr/local/etc/snort/snort_32334_re1/snort.conf(351) Unknown output plugin: "alert_pf"
                                  1 Reply Last reply Reply Quote 0
                                  • V
                                    VeGeTa-X
                                    last edited by

                                    Does "Block Offenders" in snort with with pfsense i386?

                                    1 Reply Last reply Reply Quote 0
                                    • C
                                      Cino
                                      last edited by

                                      @VeGeTa-X:

                                      Does "Block Offenders" in snort with with pfsense i386?

                                      it works on i386, just not on amd64

                                      1 Reply Last reply Reply Quote 0
                                      • A
                                        asterix
                                        last edited by

                                        @Cino:

                                        @asterix:

                                        So basically snort on amd64 is still broken.

                                        well if it runs after running a command or two, it wouldn't be broken then! Any why not just run i386? Unless your pumping heavy traffic thru the box and need a lot of memory, I see no benefit running AMD64.

                                        I have i386 on one of the boxes. For the box I want Snort on.. i386 is of no use as it can detect about 3.5GB. It made sense earlier when I started with 2GB RAM. I have 4GB RAM now and will be bumping it to 8GB this week. Traffic is extremely heavy, non-stop 24/7.. serving over 30 users on 4 different VLANs. Current bandwidth is 30/4. Will be switching to FTTH 50/25 (or more) soon.

                                        1 Reply Last reply Reply Quote 0
                                        • G
                                          Gloom
                                          last edited by

                                          Is the code for the 64 bit build available somewhere? I've got a few quiet days this week and would like to see if I can sort the "block offenders" problem on that package.

                                          Never underestimate the power of human stupidity

                                          1 Reply Last reply Reply Quote 0
                                          • AhnHELA
                                            AhnHEL
                                            last edited by

                                            @dwood:

                                            With "Block Offenders" checked, the system log returns: snort[37235]: FATAL ERROR: /usr/local/etc/snort/snort_32334_re1/snort.conf(351) Unknown output plugin: "alert_pf"

                                            Seeing this error myself on amd64 with "block offenders" checked.

                                            snort[22035]: FATAL ERROR: /usr/local/etc/snort/snort_44446_re1/snort.conf(343) Unknown output plugin: "alert_pf"

                                            AhnHEL (Angel)

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.