Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort 2.9.1 pkg v. 2.1.1 Error.

    Scheduled Pinned Locked Moved pfSense Packages
    88 Posts 27 Posters 39.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      Mattofsweden
      last edited by

      @yaojun:

      After some un-installs, reinstalls, reconfigurations, i managed to get it to show another message.

      snort[8624]: FATAL ERROR: ByteExtract variable '^Authorization\x3A\s*Basic\s+' in rule [3:13308] is used before it is defined.

      Snort is running as 2.9.1, whereas the current snort rule copy belongs to 2.9.0.5 after setting up the oink codes. Is there a bug here?

      I got the same error a week ago when I tried to setup snort 2.9.1 on AMD64 2.1-DEV a week ago. I was never able to fix it, but it's gone now when I'm running latest Snort package on i386.

      Try unchecking all rules and see if you still get the error. Also, enable all pre-processors and see if that helps.

      If it fails, remove package and remove (if any remain) traces of the "installed" snort package. Check em' by issuing the following in your ssh shell.

      find /* | grep snort

      Just don't remove package cache and that stuff.

      Regards,
      Mattias

      IT Teacher & Networking Consultant

      1 Reply Last reply Reply Quote 0
      • Y
        yaojun
        last edited by

        Some updates,

        When I tried to isolate the issue, I realised that "FATAL ERROR: ByteExtract variable '^Authorization\x3A\s*Basic\s+' in rule [3:13308] is used before it is defined" is actually caused by snort rules. When I didn't download the snort rules, but downloaded EmergingThreats rules, Snort will be able to run without crashing. After I downloaded the snort rules, the FATAL ERROR came in.

        1 Reply Last reply Reply Quote 0
        • W
          WiFiNetGuy
          last edited by

          I'm running a new install of v2.0.1 of pfS (i386). Trying to install Snort from the packages area gives me the following:

          ===============================
          Beginning package installation for snort…
          Downloading package configuration file... done.
          Saving updated package information... done.
          Downloading snort and its dependencies...
          Checking for package installation...
          Downloading http://files.pfsense.org/packages/8/All/snort-2.9.2.3.tbz ...  could not download from there or http://ftp2.FreeBSD.org/pub/FreeBSD/ports/i386/packages-8.1-release/All/snort-2.9.2.3.tbz.
          of snort-2.9.2.3 failed!

          Installation aborted.Backing up libraries...
          Removing package...
          Starting package deletion for mysql-client-5.1.53...done.
          Starting package deletion for snort-2.9.2.3...done.
          Starting package deletion for perl-threaded-5.10.1_3...done.
          Removing snort components...
          Menu items... done.
          Services... done.
          Loading package instructions...
          Include file snort.inc could not be found for inclusion.
          Deinstall commands...
          Not executing custom deinstall hook because an include is missing.
          Removing package instructions...done.
          Auxiliary files... done.
          Package XML... done.
          Configuration... done.
          Cleaning up... Failed to install package.

          Installation halted.

          Any help on installing would be appreciated. Thanks in advance.

          1 Reply Last reply Reply Quote 0
          • S
            SwedishElk
            last edited by

            Trying to install SNORT and get this:

            Beginning package installation for snort…
            Downloading package configuration file... done.
            Saving updated package information... done.
            Downloading snort and its dependencies...
            Checking for package installation...
            Downloading http://files.pfsense.org/packages/8/All/snort-2.9.2.3.tbz ...  could not download from there or http://ftp2.FreeBSD.org/pub/FreeBSD/ports/i386/packages-8.1-release/All/snort-2.9.2.3.tbz.
            of snort-2.9.2.3 failed!

            Installation aborted.Backing up libraries...
            Removing package...
            Starting package deletion for mysql-client-5.1.53...done.
            Starting package deletion for snort-2.9.2.3...done.
            Starting package deletion for perl-threaded-5.10.1_3...done.
            Removing snort components...
            Menu items... done.
            Services... done.
            Loading package instructions...
            Include file snort.inc could not be found for inclusion.
            Deinstall commands...
            Not executing custom deinstall hook because an include is missing.
            Removing package instructions...done.
            Auxiliary files... done.
            Package XML... done.
            Configuration... done.
            Cleaning up... Failed to install package.

            Installation halted.

            1 Reply Last reply Reply Quote 0
            • B
              borgotech
              last edited by

              I get the same error. Thats becouse package snort-2.9.2.3.tbz from this link http://ftp2.freebsd.org/pub/FreeBSD/ports/i386/packages-8.1-release/All/snort-2.9.2.3.tbz or from pfsense repository  http://files.pfsense.org/packages/8/All/snort-2.9.2.3.tbz doesnt exist . If you take a look at root ftp directoryon FreeBSD u will see that packages-8.1-release directory doesn exist, only thouse directory :
              packages-8-stable/ 2012-Jun-07 06:23:01 -  Directory
              packages-8.2-release/ 2011-Feb-17 07:49:54 -  Directory
              packages-8.3-release/ 2012-Mar-29 00:26:51 -  Directory
              …........................... and other ...... :)
              And also in official repository file snort-2.9.2.3.tbz doesnt exist.
              As i know latest release of pfsense is based on 8.1 FreBSD release. At this moment i will try to and change the path of snort-2.9.2.3.tbz file to http://ftp2.freebsd.org/pub/FreeBSD/ports/i386/packages-8-release/All/snort-2.9.2.3.tbz or to official old package snort-2.9.0.5.tbz http://files.pfsense.org/packages/8/All/snort-2.9.0.5tbz . This is my first time when i try to change something in pfsense :) and i dont know what is the file from where pfsense take data to install  packages. If any one can help me with that i think we can solve the problem .. I will do some research :) wish me luck

              1 Reply Last reply Reply Quote 0
              • C
                Cino
                last edited by

                this isn't the reason why btw… pfsense packages dont download from freebsd repository. they come from files.pfsense.org.. read my post http://forum.pfsense.org/index.php/topic,50301.msg267674.html#msg267674

                1 Reply Last reply Reply Quote 0
                • C
                  Cino
                  last edited by

                  search the forum before posting

                  http://forum.pfsense.org/index.php/topic,50301.msg267674.html#msg267674

                  1 Reply Last reply Reply Quote 0
                  • B
                    borgotech
                    last edited by

                    Ok i get it , the reason is ..package is missing … as i saw  :( all i whant to know is from where pfsense takes data for package install, becouse  at least i can try to change the path to install and use the old package snort-2.9.0.5 until the new one comes.

                    1 Reply Last reply Reply Quote 0
                    • C
                      Cino
                      last edited by

                      you'll find it here http://files.pfsense.org/packages/8/All/  I have a feeling its not going to work because the package install via gui is going to fail because it the file isn't there right now.

                      1 Reply Last reply Reply Quote 0
                      • U
                        unixaccent
                        last edited by

                        Same problem here.

                        1 Reply Last reply Reply Quote 0
                        • M
                          miles267
                          last edited by

                          Just ran into the same issue here.  I hope they place the latest snort package in the appropriate folder soon.

                          1 Reply Last reply Reply Quote 0
                          • S
                            sgebhard
                            last edited by

                            I tried upgrading the snort package, same error, the second URL, http://ftp2.FreeBSD.org/pub/FreeBSD/ports/i386/packages-8.1-release/All/snort-2.9.2.3.tbz, returns a 404 not found error.

                            1 Reply Last reply Reply Quote 0
                            • S
                              sekular
                              last edited by

                              http://ftp.freebsd.org/pub/FreeBSD/ports/amd64/packages-8-stable/All/snort-2.9.2.3.tbz

                              That is a corrected path for the amd64 release. It appears the 8.1 path no longer exists.

                              1 Reply Last reply Reply Quote 0
                              • T
                                tritron
                                last edited by

                                i386 is at http://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-8-stable/All/snort-2.9.2.3.tbz
                                Don't we need snort package compiled for pfsense?

                                1 Reply Last reply Reply Quote 0
                                • C
                                  Cino
                                  last edited by

                                  @tritron:

                                  Don't we need snort package compiled for pfsense?

                                  yes because there is a patch that is needed so it can integrate into pfsense for auto blocking

                                  1 Reply Last reply Reply Quote 0
                                  • U
                                    ucantekme
                                    last edited by

                                    in my case
                                    rm -r /var/db/pkg/snort-2.9.0.5_1
                                    pkg_add ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-stable/All/snort-2.9.2.3.tbz

                                    Then I try to install snort 2.9.2.3 from pfsense package manager again. It's only install perl-threaded-5.10.1_3.tbz from package manager.
                                    Now snort 2.9.2.3 is running on my PfSense 2.0.1 i386

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      sirWest
                                      last edited by

                                      @ucantekme:

                                      in my case
                                      rm -r /var/db/pkg/snort-2.9.0.5_1
                                      pkg_add ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-stable/All/snort-2.9.2.3.tbz

                                      Then I try to install snort 2.9.2.3 from pfsense package manager again. It's only install perl-threaded-5.10.1_3.tbz from package manager.
                                      Now snort 2.9.2.3 is running on my PfSense 2.0.1 i386

                                      Thanks a million dude, it works! :)

                                      1 Reply Last reply Reply Quote 0
                                      • C
                                        Cino
                                        last edited by

                                        @ucantekme:

                                        in my case
                                        rm -r /var/db/pkg/snort-2.9.0.5_1
                                        pkg_add ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-stable/All/snort-2.9.2.3.tbz

                                        Then I try to install snort 2.9.2.3 from pfsense package manager again. It's only install perl-threaded-5.10.1_3.tbz from package manager.
                                        Now snort 2.9.2.3 is running on my PfSense 2.0.1 i386

                                        Is auto blocking working?

                                        1 Reply Last reply Reply Quote 0
                                        • C
                                          condector
                                          last edited by

                                          Install.. but snort don't start.

                                          pfSense 2.0.1 AMD64:

                                          pkg_add http://ftp.freebsd.org/pub/FreeBSD/ports/amd64/packages-stable/All/snort-2.9.2.3.tbz

                                          1 Reply Last reply Reply Quote 0
                                          • S
                                            sirWest
                                            last edited by

                                            @condector:

                                            Install.. but snort don't start.

                                            pfSense 2.0.1 AMD64:

                                            pkg_add http://ftp.freebsd.org/pub/FreeBSD/ports/amd64/packages-stable/All/snort-2.9.2.3.tbz

                                            yes sadly the same problem here - it was too soon to cheer, it installed everything fine and configuration went fine but it won't start and no error message also. Strange is that on snort page it says the old package version not the new one…

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.