Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort Stable 2.9.2.3 pkg v. 2.2 Failed

    Scheduled Pinned Locked Moved pfSense Packages
    102 Posts 33 Posters 34.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      Razor_FX_II
      last edited by

      Uninstall / Install package snort-2.9.2.3 "2.2.1" / Reboot
      Systems log: SnortStartup[16137]: Snort HARD START For 64152_em0…

      Snort will not start. >:(

      1 Reply Last reply Reply Quote 0
      • F
        feadin
        last edited by

        When running /usr/local/bin/snort from command line it says:

        /usr/local/lib/libdnet.1: unsupported file layout

        I reinstalled all the dependencies just in case but no change. Even downloaded libdnet-1.11_3.tbz from other sources and still the same error.

        1 Reply Last reply Reply Quote 0
        • M
          mschiek01
          last edited by

          @Feadin:

          When running /usr/local/bin/snort from command line it says:

          /usr/local/lib/libdnet.1: unsupported file layout

          I reinstalled all the dependencies just in case but no change. Even downloaded libdnet-1.11_3.tbz from other sources and still the same error.

          Try the following:

          Run this command from the command line:

          pkg_add -f http://files.pfsense.org/packages/8/All/snort-2.9.2.3.tbz

          Delete anything in this directory

          /usr/local/lib/snort/dynamicrules
          also uncheck any .so rules on your interfaces.

          Then update snort rules and start snort

          1 Reply Last reply Reply Quote 0
          • F
            feadin
            last edited by

            Ok did all that and is the same thing. I noticed something strange, I don't know if this is related. When installing snort it complains with this warning:

            pkg_add: warning: package 'snort-2.9.2.3' requires 'libpcap-1.1.1_1', but 'libpcap-1.2.1' is installed

            I reinstalled all dependencies again and package daq complains like this:

            pkg_add: warning: package 'daq-0.6.2' requires 'libpcap-1.2.1', but 'libpcap-1.1.1_1' is installed

            Could that be the problem? I don't know what else to try…

            BTW I do have installed both libpcap 1.1.1 and 1.2.1 . All dependencies are correctly installed.

            1 Reply Last reply Reply Quote 0
            • M
              mschiek01
              last edited by

              @Feadin:

              Ok did all that and is the same thing. I noticed something strange, I don't know if this is related. When installing snort it complains with this warning:

              pkg_add: warning: package 'snort-2.9.2.3' requires 'libpcap-1.1.1_1', but 'libpcap-1.2.1' is installed

              I reinstalled all dependencies again and package daq complains like this:

              pkg_add: warning: package 'daq-0.6.2' requires 'libpcap-1.2.1', but 'libpcap-1.1.1_1' is installed

              Could that be the problem? I don't know what else to try…

              BTW I do have installed both libpcap 1.1.1 and 1.2.1 . All dependencies are correctly installed.

              Try to reinstall libcap-1.1.1_1

              use this command which will force the reinstall from the command line.

              pkg_add -f http://files.pfsense.org/packages/8/All/libpcap-1.1.1.tbz

              Then

              pkg_add -f http://files.pfsense.org/packages/8/All/libpcap-1.1.1_1.tbz

              1 Reply Last reply Reply Quote 0
              • F
                feadin
                last edited by

                [2.0.1-RELEASE][admin@pfsense.lan]/root(17): pkg_add -f http://files.pfsense.org/packages/8/All/libpcap-1.1.1.tbz
                Fetching http://files.pfsense.org/packages/8/All/libpcap-1.1.1.tbz… Done.
                [2.0.1-RELEASE][admin@pfsense.lan]/root(18): pkg_add -f http://files.pfsense.org/packages/8/All/libpcap-1.1.1_1.tbz
                Fetching http://files.pfsense.org/packages/8/All/libpcap-1.1.1_1.tbz… Done.
                [2.0.1-RELEASE][admin@pfsense.lan]/root(19): /usr/local/bin/snort
                /libexec/ld-elf.so.1: /usr/local/lib/libdnet.1: unsupported file layout
                [2.0.1-RELEASE][admin@pfsense.lan]/root(20):

                :(

                1 Reply Last reply Reply Quote 0
                • M
                  mschiek01
                  last edited by

                  pkg_info

                  what libpcap shows installed?

                  on my boxes I only show libpcap-1.1.1_1

                  you could try deleting any other ones with pkg_delete

                  1 Reply Last reply Reply Quote 0
                  • F
                    feadin
                    last edited by

                    I have:

                    libpcap-1.1.1       Ubiquitous network traffic capture library
libpcap-1.1.1_1     Ubiquitous network traffic capture library
libpcap-1.2.1       Ubiquitous network traffic capture library

                    I tried to delete libpcap-1.2.1 but daq-0.6.2 depends on it. Deleting libpcap-1.1.1 (not _1) makes no difference at all.

                    UPDATE: Did a pkg_delete -f libpcap-1.2.1, then reinstalled libpcap-1.1.1_1 and still same error as always:

                    /libexec/ld-elf.so.1: /usr/local/lib/libdnet.1: unsupported file layout
                    1 Reply Last reply Reply Quote 0
                    • E
                      eri--
                      last edited by

                      The issue with old code that is present when you uypgrade to a new version will be there even when you reinstall since the damage from old code will be done.

                      Feadin,

                      that is why for 2.1 we are moving to PBIs to make especially this dependency issues go away once and for good.
                      For now you have to clean your environment from other packages you have as well and reinstall again.

                      1 Reply Last reply Reply Quote 0
                      • D
                        digdug3
                        last edited by

                        Snort Stable 2.9.2.3 pkg v. 2.2.1 (AMD64) won't start

                        After removing Snort Snort Stable 2.9.2.3 pkg v. 2.2 and reinstalling Snort Stable 2.9.2.3 pkg v. 2.2.1 snort won't start.
                        No messages in the system log, only "Jun 15 08:58:09 pfsense SnortStartup[46856]: Snort HARD START For xxxxx_em1…"

                        Tried removing, rebooting, reinstalling, same issue.
                        (Only had snort widget as an added package.)

                        1 Reply Last reply Reply Quote 0
                        • C
                          chowtamah
                          last edited by

                          Same for my case!

                          Snort Stable 2.9.2.3 pkg v. 2.2.1 (AMD64) won't start

                          If I try to start the snort from Services menu, I get this in System logs

                          • SnortStartup[43771]: Snort HARD START For 49607_em1…

                          From snort interface - start, I get this message,

                          • SnortStartup[24252]: Interface Rule START for 0_40330_em1…
                          • SnortStartup[59413]: Toggle for 40330_em1…

                          But services and snort interface shows that snort is not running.

                          Pfsense 2.0.1-RELEASE (amd64)

                          2.0.2-RELEASE (amd64)  &  2.2.2-RELEASE (amd64)

                          Always trying to learn!!

                          1 Reply Last reply Reply Quote 0
                          • E
                            eri--
                            last edited by

                            If you do not get anything on the system logs probably the package did not install at all!?
                            Is the snort binary installed?

                            1 Reply Last reply Reply Quote 0
                            • F
                              fragged
                              last edited by

                              @ermal:

                              If you do not get anything on the system logs probably the package did not install at all!?
                              Is the snort binary installed?

                              How do I check for that? I'm a total FreeBSD noob :)

                              1 Reply Last reply Reply Quote 0
                              • E
                                eri--
                                last edited by

                                I added explicit dependencies on the package instalaltion so it pulls the right packages needed.
                                Can you try after 10 minutes from this post and see?

                                1 Reply Last reply Reply Quote 0
                                • C
                                  chowtamah
                                  last edited by

                                  I tried installation once again. But still same problem. ???

                                  2.0.2-RELEASE (amd64)  &  2.2.2-RELEASE (amd64)

                                  Always trying to learn!!

                                  1 Reply Last reply Reply Quote 0
                                  • F
                                    fragged
                                    last edited by

                                    Same here with fresh installation on a Virtualbox VM running
                                    2.0.1-RELEASE (amd64)
                                    built on Mon Dec 12 18:16:13 EST 2011

                                    FreeBSD 8.1-RELEASE-p6

                                    Only log line generated: SnortStartup[48564]: Snort HARD START For 23366_em1…

                                    I only did basic settings and installed + configured snort with 1 rule category selected.

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      mschiek01
                                      last edited by

                                      @ermal:

                                      @miles267:

                                      Has anyone else noticed on their Snort > Blocked (tab) that the ALERT DESCRIPTION next to each IP now says "N/A" instead of displaying a full description as it has in the past?

                                      I've confirmed under Snort > Global Settings, my Alert file description type = FULL.

                                      Is there any way to restore this functionality so that full alert description is listed?

                                      It should work on latest version 2.2.1

                                      This is still not working in the latest version 2.2.1

                                      1 Reply Last reply Reply Quote 0
                                      • R
                                        Razor_FX_II
                                        last edited by

                                        pfSense 2.1-BETA0 (amd64) built on Thu Jun 14 14:23:20 EDT 2012
                                        snort 2.9.2.3 pkg v. 2.2.1

                                        snort will not start.

                                        System Log:
                                        Jun 15 07:56:44 snort[49817]: FATAL ERROR: /usr/local/etc/snort/snort_39668_em0/snort.conf(324) Unknown output plugin: "alert_pf"
                                        Jun 15 07:56:44 snort[49817]: FATAL ERROR: /usr/local/etc/snort/snort_39668_em0/snort.conf(324) Unknown output plugin: "alert_pf"

                                        1 Reply Last reply Reply Quote 0
                                        • D
                                          digdug3
                                          last edited by

                                          @ermal

                                          Snort Stable 2.9.2.3 pkg v. 2.2.1 (AMD64)

                                          Tried running snort from shell:

                                          /libexec/ld-elf.so.1: /usr/local/lib/libdnet.1: unsupported file layout
                                          1 Reply Last reply Reply Quote 0
                                          • F
                                            feadin
                                            last edited by

                                            Was daq-0.6.2.tbz introduced recently? Since daq depends on libpcap-1.2.1 and snort on libpcap-1.1.1_1 maybe that be the source of the problems? I don't know if libdnet uses libpcap or daq (at time of compilation or later), but if it does maybe there is the issue.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.