Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort 2.9.1 pkg v. 2.1.1 Error.

    Scheduled Pinned Locked Moved pfSense Packages
    88 Posts 27 Posters 39.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • U
      ucantekme
      last edited by

      It's my test box so no problem :)

      1 Reply Last reply Reply Quote 0
      • E
        expert_az
        last edited by

        same error

        My system :
        2.0.1-RELEASE (amd64)
        built on Mon Dec 12 18:43:51 EST 2011
        FreeBSD 8.1-RELEASE-p6

        Beginning package installation for snort…
        Downloading package configuration file... done.
        Saving updated package information... done.
        Downloading snort and its dependencies...
        Checking for package installation...
        Downloading http://files.pfsense.org/packages/amd64/8/All/snort-2.9.2.3.tbz ...  could not download from there or http://ftp2.FreeBSD.org/pub/FreeBSD/ports/amd64/packages-8.1-release/All/snort-2.9.2.3.tbz.
        of snort-2.9.2.3 failed!

        Installation aborted.Backing up libraries...
        Removing package...
        Starting package deletion for mysql-client-5.1.53...done.
        Starting package deletion for snort-2.9.2.3...done.
        Starting package deletion for perl-threaded-5.10.1_3...done.
        Removing snort components...
        Menu items... done.
        Services... done.
        Loading package instructions...
        Include file snort.inc could not be found for inclusion.
        Deinstall commands...
        Not executing custom deinstall hook because an include is missing.
        Removing package instructions...done.
        Auxiliary files... done.
        Package XML... done.
        Configuration... done.
        Cleaning up... Failed to install package.

        Installation halted.

        1 Reply Last reply Reply Quote 0
        • D
          darklogic
          last edited by

          Same issue here as well.

          1 Reply Last reply Reply Quote 0
          • C
            condector
            last edited by

            Online again! Thanks!

            1 Reply Last reply Reply Quote 0
            • jimpJ
              jimp Rebel Alliance Developer Netgate
              last edited by

              Yes this should be OK now, I managed to get a new set of binaries built and uploaded. For one reason or another the nightly automated build process (even when run by hand) was not completely building the snort package and related binaries.

              Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

              Need help fast? Netgate Global Support!

              Do not Chat/PM for help!

              1 Reply Last reply Reply Quote 0
              • C
                condector
                last edited by

                But now I have another problem…

                snort[25261]: FATAL ERROR: ByteExtract variable '^Authorization\x3A\s*Basic[ \t]+' in rule [3:13308] is used before it is defined.

                Snort install perfectly, but not work…

                1 Reply Last reply Reply Quote 0
                • P
                  pfsparc
                  last edited by

                  Same here:
                  snort[56806]: FATAL ERROR: ByteExtract variable '^Authorization\x3A\s*Basic[ \t]+' in rule [3:13308] is used before it is defined.

                  1 Reply Last reply Reply Quote 0
                  • jimpJ
                    jimp Rebel Alliance Developer Netgate
                    last edited by

                    Might be related:
                    http://forum.pfsense.org/index.php/topic,45656.msg238815.html#msg238815

                    Try updating your snort rules.

                    Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                    Need help fast? Netgate Global Support!

                    Do not Chat/PM for help!

                    1 Reply Last reply Reply Quote 0
                    • C
                      Cino
                      last edited by

                      i'm doing some testing but since snort was updated to 2.9.2.3, the ruleset filename is different:

                      thinking it should be like this now
                      /usr/local/pkg/snort/snort_check_for_rule_updates.php
                      line 43 $snort_filename_md5 = "snortrules-snapshot-2923.tar.gz.md5";
                      line 44 $snort_filename = "snortrules-snapshot-2923.tar.gz";

                      1 Reply Last reply Reply Quote 0
                      • C
                        Cino
                        last edited by

                        @Cino:

                        i'm doing some testing but since snort was updated to 2.9.2.3, the ruleset filename is different:

                        thinking it should be like this now
                        /usr/local/pkg/snort/snort_check_for_rule_updates.php
                        line 43 $snort_filename_md5 = "snortrules-snapshot-2923.tar.gz.md5";
                        line 44 $snort_filename = "snortrules-snapshot-2923.tar.gz";

                        P.S looks like only registered users can download snortrules-snapshot-2922.tar.gz, 2923 isn't allowed yet

                        1 Reply Last reply Reply Quote 0
                        • C
                          condector
                          last edited by

                          Strange.. my rules are updated…

                          SNORT.ORG >>>  "b7469cefc799ed158d2a483ed2cf689a"
                          EMERGINGTHREATS.NET >>>  014686a49ac68a7d90d9be60b5db93bc
                          PFSENSE.ORG >>>  "e8a95fd5f1b40e878fedeffd585134bb"

                          1 Reply Last reply Reply Quote 0
                          • C
                            condector
                            last edited by

                            Another thing… my Snort Service show:  Snort 2.9.1 v. pkg 2.1.1, I will try remove and add again.

                            1 Reply Last reply Reply Quote 0
                            • C
                              Cino
                              last edited by

                              @condector:

                              Strange.. my rules are updated…

                              SNORT.ORG >>>  "b7469cefc799ed158d2a483ed2cf689a"
                              EMERGINGTHREATS.NET >>>  014686a49ac68a7d90d9be60b5db93bc
                              PFSENSE.ORG >>>  "e8a95fd5f1b40e878fedeffd585134bb"

                              yeah, the rules will update; but did snort start?

                              Snort 2.9.1 v. pkg 2.1 is hardcoded into the code i believe, it wasn't updated.. only binaries from what i can tell.

                              P.S line 40 in /usr/usr/local/snort/snort.inc would need to be changed for the version number

                              1 Reply Last reply Reply Quote 0
                              • C
                                condector
                                last edited by

                                Cino,

                                I try start snort.. but the error is:

                                snort[15802]: FATAL ERROR: ByteExtract variable '^Authorization\x3A\s*Basic[ \t]+' in rule [3:13308] is used before it is defined.

                                1 Reply Last reply Reply Quote 0
                                • M
                                  mschiek01
                                  last edited by

                                  snort[56806]: FATAL ERROR: ByteExtract variable '^Authorization\x3A\s*Basic[ \t]+' in rule [3:13308] is used before it is defined.

                                  Updated to latest ruleset same error.

                                  1 Reply Last reply Reply Quote 0
                                  • C
                                    condector
                                    last edited by

                                    Using only Emmerging Threads rules…

                                    1 Reply Last reply Reply Quote 0
                                    • C
                                      condector
                                      last edited by

                                      Solved.

                                      I remove and delete all Snort entries on pfSense (find / -name snort)

                                      After that all work perfectly.

                                      Barnyard2 downloaded manually of course.

                                      Thanks,
                                      Brivaldo Jr

                                      1 Reply Last reply Reply Quote 0
                                      • B
                                        borgotech
                                        last edited by

                                        Solved .  Snort Interfaces > e (edit interface) > Categories …. now here first try to uncheck all of you ruleset and then try to start you snort. After that you can "check" and enable  Ruleset from Category tab ... but Attention !!! with some of ruleset snort will not start. So my advice is .. "check" and enable a ruleset, restart snort to see if works (start)... and so on .

                                        Srry for my language

                                        Best Regards

                                        Edited at 05:10:49 pm:
                                        Weird ...worked only with Emmerging Rulsets , if i use snort rulsets snort doesnt start. ...... i will try again  .. to search where is the problem

                                        1 Reply Last reply Reply Quote 0
                                        • S
                                          sgebhard
                                          last edited by

                                          Hopefully there will  be a fix soon, it blew out my snort completely, so now I have nothing

                                          1 Reply Last reply Reply Quote 0
                                          • S
                                            sgebhard
                                            last edited by

                                            Just tried install on snort, it works now

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.