Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort 2.9.1 pkg v. 2.1.1 Error.

    Scheduled Pinned Locked Moved pfSense Packages
    88 Posts 27 Posters 39.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • Y
      yaojun
      last edited by

      Some updates,

      When I tried to isolate the issue, I realised that "FATAL ERROR: ByteExtract variable '^Authorization\x3A\s*Basic\s+' in rule [3:13308] is used before it is defined" is actually caused by snort rules. When I didn't download the snort rules, but downloaded EmergingThreats rules, Snort will be able to run without crashing. After I downloaded the snort rules, the FATAL ERROR came in.

      1 Reply Last reply Reply Quote 0
      • W
        WiFiNetGuy
        last edited by

        I'm running a new install of v2.0.1 of pfS (i386). Trying to install Snort from the packages area gives me the following:

        ===============================
        Beginning package installation for snort…
        Downloading package configuration file... done.
        Saving updated package information... done.
        Downloading snort and its dependencies...
        Checking for package installation...
        Downloading http://files.pfsense.org/packages/8/All/snort-2.9.2.3.tbz ...  could not download from there or http://ftp2.FreeBSD.org/pub/FreeBSD/ports/i386/packages-8.1-release/All/snort-2.9.2.3.tbz.
        of snort-2.9.2.3 failed!

        Installation aborted.Backing up libraries...
        Removing package...
        Starting package deletion for mysql-client-5.1.53...done.
        Starting package deletion for snort-2.9.2.3...done.
        Starting package deletion for perl-threaded-5.10.1_3...done.
        Removing snort components...
        Menu items... done.
        Services... done.
        Loading package instructions...
        Include file snort.inc could not be found for inclusion.
        Deinstall commands...
        Not executing custom deinstall hook because an include is missing.
        Removing package instructions...done.
        Auxiliary files... done.
        Package XML... done.
        Configuration... done.
        Cleaning up... Failed to install package.

        Installation halted.

        Any help on installing would be appreciated. Thanks in advance.

        1 Reply Last reply Reply Quote 0
        • S
          SwedishElk
          last edited by

          Trying to install SNORT and get this:

          Beginning package installation for snort…
          Downloading package configuration file... done.
          Saving updated package information... done.
          Downloading snort and its dependencies...
          Checking for package installation...
          Downloading http://files.pfsense.org/packages/8/All/snort-2.9.2.3.tbz ...  could not download from there or http://ftp2.FreeBSD.org/pub/FreeBSD/ports/i386/packages-8.1-release/All/snort-2.9.2.3.tbz.
          of snort-2.9.2.3 failed!

          Installation aborted.Backing up libraries...
          Removing package...
          Starting package deletion for mysql-client-5.1.53...done.
          Starting package deletion for snort-2.9.2.3...done.
          Starting package deletion for perl-threaded-5.10.1_3...done.
          Removing snort components...
          Menu items... done.
          Services... done.
          Loading package instructions...
          Include file snort.inc could not be found for inclusion.
          Deinstall commands...
          Not executing custom deinstall hook because an include is missing.
          Removing package instructions...done.
          Auxiliary files... done.
          Package XML... done.
          Configuration... done.
          Cleaning up... Failed to install package.

          Installation halted.

          1 Reply Last reply Reply Quote 0
          • B
            borgotech
            last edited by

            I get the same error. Thats becouse package snort-2.9.2.3.tbz from this link http://ftp2.freebsd.org/pub/FreeBSD/ports/i386/packages-8.1-release/All/snort-2.9.2.3.tbz or from pfsense repository  http://files.pfsense.org/packages/8/All/snort-2.9.2.3.tbz doesnt exist . If you take a look at root ftp directoryon FreeBSD u will see that packages-8.1-release directory doesn exist, only thouse directory :
            packages-8-stable/ 2012-Jun-07 06:23:01 -  Directory
            packages-8.2-release/ 2011-Feb-17 07:49:54 -  Directory
            packages-8.3-release/ 2012-Mar-29 00:26:51 -  Directory
            …........................... and other ...... :)
            And also in official repository file snort-2.9.2.3.tbz doesnt exist.
            As i know latest release of pfsense is based on 8.1 FreBSD release. At this moment i will try to and change the path of snort-2.9.2.3.tbz file to http://ftp2.freebsd.org/pub/FreeBSD/ports/i386/packages-8-release/All/snort-2.9.2.3.tbz or to official old package snort-2.9.0.5.tbz http://files.pfsense.org/packages/8/All/snort-2.9.0.5tbz . This is my first time when i try to change something in pfsense :) and i dont know what is the file from where pfsense take data to install  packages. If any one can help me with that i think we can solve the problem .. I will do some research :) wish me luck

            1 Reply Last reply Reply Quote 0
            • C
              Cino
              last edited by

              this isn't the reason why btw… pfsense packages dont download from freebsd repository. they come from files.pfsense.org.. read my post http://forum.pfsense.org/index.php/topic,50301.msg267674.html#msg267674

              1 Reply Last reply Reply Quote 0
              • C
                Cino
                last edited by

                search the forum before posting

                http://forum.pfsense.org/index.php/topic,50301.msg267674.html#msg267674

                1 Reply Last reply Reply Quote 0
                • B
                  borgotech
                  last edited by

                  Ok i get it , the reason is ..package is missing … as i saw  :( all i whant to know is from where pfsense takes data for package install, becouse  at least i can try to change the path to install and use the old package snort-2.9.0.5 until the new one comes.

                  1 Reply Last reply Reply Quote 0
                  • C
                    Cino
                    last edited by

                    you'll find it here http://files.pfsense.org/packages/8/All/  I have a feeling its not going to work because the package install via gui is going to fail because it the file isn't there right now.

                    1 Reply Last reply Reply Quote 0
                    • U
                      unixaccent
                      last edited by

                      Same problem here.

                      1 Reply Last reply Reply Quote 0
                      • M
                        miles267
                        last edited by

                        Just ran into the same issue here.  I hope they place the latest snort package in the appropriate folder soon.

                        1 Reply Last reply Reply Quote 0
                        • S
                          sgebhard
                          last edited by

                          I tried upgrading the snort package, same error, the second URL, http://ftp2.FreeBSD.org/pub/FreeBSD/ports/i386/packages-8.1-release/All/snort-2.9.2.3.tbz, returns a 404 not found error.

                          1 Reply Last reply Reply Quote 0
                          • S
                            sekular
                            last edited by

                            http://ftp.freebsd.org/pub/FreeBSD/ports/amd64/packages-8-stable/All/snort-2.9.2.3.tbz

                            That is a corrected path for the amd64 release. It appears the 8.1 path no longer exists.

                            1 Reply Last reply Reply Quote 0
                            • T
                              tritron
                              last edited by

                              i386 is at http://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-8-stable/All/snort-2.9.2.3.tbz
                              Don't we need snort package compiled for pfsense?

                              1 Reply Last reply Reply Quote 0
                              • C
                                Cino
                                last edited by

                                @tritron:

                                Don't we need snort package compiled for pfsense?

                                yes because there is a patch that is needed so it can integrate into pfsense for auto blocking

                                1 Reply Last reply Reply Quote 0
                                • U
                                  ucantekme
                                  last edited by

                                  in my case
                                  rm -r /var/db/pkg/snort-2.9.0.5_1
                                  pkg_add ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-stable/All/snort-2.9.2.3.tbz

                                  Then I try to install snort 2.9.2.3 from pfsense package manager again. It's only install perl-threaded-5.10.1_3.tbz from package manager.
                                  Now snort 2.9.2.3 is running on my PfSense 2.0.1 i386

                                  1 Reply Last reply Reply Quote 0
                                  • S
                                    sirWest
                                    last edited by

                                    @ucantekme:

                                    in my case
                                    rm -r /var/db/pkg/snort-2.9.0.5_1
                                    pkg_add ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-stable/All/snort-2.9.2.3.tbz

                                    Then I try to install snort 2.9.2.3 from pfsense package manager again. It's only install perl-threaded-5.10.1_3.tbz from package manager.
                                    Now snort 2.9.2.3 is running on my PfSense 2.0.1 i386

                                    Thanks a million dude, it works! :)

                                    1 Reply Last reply Reply Quote 0
                                    • C
                                      Cino
                                      last edited by

                                      @ucantekme:

                                      in my case
                                      rm -r /var/db/pkg/snort-2.9.0.5_1
                                      pkg_add ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-stable/All/snort-2.9.2.3.tbz

                                      Then I try to install snort 2.9.2.3 from pfsense package manager again. It's only install perl-threaded-5.10.1_3.tbz from package manager.
                                      Now snort 2.9.2.3 is running on my PfSense 2.0.1 i386

                                      Is auto blocking working?

                                      1 Reply Last reply Reply Quote 0
                                      • C
                                        condector
                                        last edited by

                                        Install.. but snort don't start.

                                        pfSense 2.0.1 AMD64:

                                        pkg_add http://ftp.freebsd.org/pub/FreeBSD/ports/amd64/packages-stable/All/snort-2.9.2.3.tbz

                                        1 Reply Last reply Reply Quote 0
                                        • S
                                          sirWest
                                          last edited by

                                          @condector:

                                          Install.. but snort don't start.

                                          pfSense 2.0.1 AMD64:

                                          pkg_add http://ftp.freebsd.org/pub/FreeBSD/ports/amd64/packages-stable/All/snort-2.9.2.3.tbz

                                          yes sadly the same problem here - it was too soon to cheer, it installed everything fine and configuration went fine but it won't start and no error message also. Strange is that on snort page it says the old package version not the new one…

                                          1 Reply Last reply Reply Quote 0
                                          • C
                                            Cino
                                            last edited by

                                            @sirWest:

                                            Strange is that on snort page it says the old package version not the new one…

                                            It would because the GUI is from pfSense.. Snort doesn't come with a GUI… You have to create the config files by hand... pfSense GUI creates the files for us

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.