• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Snort 2.9.2.3 pkg v. 2.2.2 - No Alert Description

Scheduled Pinned Locked Moved pfSense Packages
42 Posts 9 Posters 19.3k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • F
    Fesoj
    last edited by Jul 8, 2012, 10:42 AM

    A8,

    thanks for the patch. I've installed System: Patches, but testing your patch gives

    Patch can be applied cleanly

    which is good, but

    Patch can NOT be reverted cleanly

    which is probably bad. The details are:

    Output of full patch revert test:
    /usr/bin/patch –directory=/usr/local/www/snort/ -f -p0 -i /var/patches/4ff962e6d4837.patch --check --reverse

    Hmm...  Looks like a unified diff to me...
    The text leading up to this was:

    -- /usr/local/www/snort/snort_blocked.php.broken 2012-07-07 21:54:14.000000000 -0600

    +++ /usr/local/www/snort/snort_blocked.php 2012-07-08 03:38:13.000000000 -0600
    Patching file /usr/local/www/snort/snort_blocked.php using Plan A...
    Hunk #1 failed at 39.
    Hunk #2 failed at 69.
    Hunk #3 failed at 131.
    Hunk #4 failed at 282.
    4 out of 4 hunks failed--saving rejects to /usr/local/www/snort/snort_blocked.php.rej
    done

    Do I need to worry about this?

    1 Reply Last reply Reply Quote 0
    • C
      Cino
      last edited by Jul 8, 2012, 11:45 AM

      Gave it try this morning and its working for me. Thanks!

      1 Reply Last reply Reply Quote 0
      • C
        Cino
        last edited by Jul 8, 2012, 11:49 AM

        @Fesoj You don't need to worry about that because you didn't apply the patch. Once your apply, it will be the other way around

        1 Reply Last reply Reply Quote 0
        • F
          Fesoj
          last edited by Jul 8, 2012, 12:00 PM

          Cino,

          thanx for the info–I just didn't want to run into more problems. Of course, deleting and reinstalling the package also doesn't take too much time.

          The patch works for me  as well. :)

          1 Reply Last reply Reply Quote 0
          • C
            chowtamah
            last edited by Jul 8, 2012, 3:34 PM

            Fesoj, whether this patch can be included in the next snort release?

            2.0.2-RELEASE (amd64)  &  2.2.2-RELEASE (amd64)

            Always trying to learn!!

            1 Reply Last reply Reply Quote 0
            • F
              Fesoj
              last edited by Jul 8, 2012, 4:32 PM

              It's not up to me to decide that. A8s patch seems to work, so it should be included to get the alert descriptions.

              Unfortunately there is more to do to get snort running smoothly again. I am currently taking a crash course (coming from C/C++) on php in order to take care of some of the more peripheric issues myself and slowly learn more about the package. I have also started to setup a test environment for more experiments…

              Maybe the ioctl error is currently the most severe problem. I cannot repeat it reliably yet, and it sometimes seems to be associated with a total freeze of the interface (so you can no longer log into the box, but existing connections are not affected).

              1 Reply Last reply Reply Quote 0
              • D
                dwood
                last edited by Jul 8, 2012, 4:49 PM

                installed 2.2.4 and added this patch.

                Alert description have returned :-)  Thank you for your efforts.

                Cheers,
                Dennis

                1 Reply Last reply Reply Quote 0
                • D
                  dwood
                  last edited by Jul 8, 2012, 4:51 PM

                  This patch on 2.2.4 (clean install, AMD64, 2.01) worked for me.

                  Descriptions in blocked IPs are back :-)  Thanks again and as always for your efforts guys.

                  Cheers,
                  Dennis.

                  1 Reply Last reply Reply Quote 0
                  • C
                    chowtamah
                    last edited by Jul 9, 2012, 6:53 AM

                    Today reinstalled Snort 2.9.2.3 pkg v. 2.2.4,

                    In Blocked tab, Alert description still shows N/A.
                    But in Alerts tab, alerts are showing up.

                    In Alerts tab, If I select Wan or Lan from the Instance to inspect, nothing shows up. If I click 'Alerts' tab again, list comes back.

                    I didn't tried the patch, as I could not install the System Patches package due to repository error. It shows, 'Unable to retrieve package info from www.pfsense.com. Cached data will be used.'

                    2.0.2-RELEASE (amd64)  &  2.2.2-RELEASE (amd64)

                    Always trying to learn!!

                    1 Reply Last reply Reply Quote 0
                    • F
                      Fesoj
                      last edited by Jul 9, 2012, 9:05 AM

                      You do need the System Patches (or do a manual merge ;D).
                      I installed the package yesterday and all went well–-maybe it is a temporary problem.
                      The GUI Alert portion of the snort package still needs work. As described somewhere else in this forum, the php code that distinguishes the selected snort interface is incomplete.

                      1 Reply Last reply Reply Quote 0
                      • _
                        _igor_
                        last edited by Jul 9, 2012, 9:30 AM

                        Applied the patch on v2.2.4 of snort and got back descriptions. Great work!!! Thx! :)

                        1 Reply Last reply Reply Quote 0
                        • 1
                          10101000
                          last edited by Jul 9, 2012, 9:52 AM Jul 9, 2012, 9:49 AM

                          @chowtamah:

                          Today reinstalled Snort 2.9.2.3 pkg v. 2.2.4,

                          In Blocked tab, Alert description still shows N/A.
                          But in Alerts tab, alerts are showing up.

                          In Alerts tab, If I select Wan or Lan from the Instance to inspect, nothing shows up. If I click 'Alerts' tab again, list comes back.

                          I didn't tried the patch, as I could not install the System Patches package due to repository error. It shows, 'Unable to retrieve package info from www.pfsense.com. Cached data will be used.'

                          Chowtamah,

                          Actually you can apply the patch from a terminal session. For this I've attached snort_blocked_patch.txt. To test that the patch is successful run:

                          patch -C -p0 -i snort_blocked_patch.txt
                          

                          If no errors are output, perform the actual patch:

                          patch -p0 -i snort_blocked_patch.txt
                          

                          I am happy to hear that this is working for most.

                          Thanks

                          snort_blocked_patch.txt

                          1 Reply Last reply Reply Quote 0
                          • E
                            eri--
                            last edited by Jul 9, 2012, 5:21 PM

                            I merged your regex into the 2.3.0 so please test if it fixes.

                            1 Reply Last reply Reply Quote 0
                            • F
                              fragged
                              last edited by Jul 9, 2012, 6:53 PM

                              It seems like the Alert Descriptions changed from N/A to nothing. Also I'm now unable to save my suppression list. It just returns to the same form with no input in any of the fields.

                              1 Reply Last reply Reply Quote 0
                              • E
                                eri--
                                last edited by Jul 9, 2012, 11:08 PM

                                Can you put from different people small part of your alert files?
                                They are in /var/log/snort*

                                1 Reply Last reply Reply Quote 0
                                • C
                                  chowtamah
                                  last edited by Jul 10, 2012, 12:45 AM

                                  Thanks to 10101000, Fesoj and ermal for all your efforts.

                                  I will test snort 2.3.0 and raise issues in cino's thread.

                                  2.0.2-RELEASE (amd64)  &  2.2.2-RELEASE (amd64)

                                  Always trying to learn!!

                                  1 Reply Last reply Reply Quote 0
                                  • F
                                    fragged
                                    last edited by Jul 10, 2012, 2:36 AM

                                    Alert Descriptions are shown on the alerts page, but not on blocked.

                                    From /var/log/snort/snort_em033213/alert

                                    
                                    [**] [1:2002157:10] ET POLICY Skype User-Agent detected [**]
                                    [Classification: Potential Corporate Privacy Violation] [Priority: 1] 
                                    07/10-05:26:57.360499 MYIP:47603 -> 204.9.163.247:80
                                    TCP TTL:50 TOS:0x0 ID:31437 IpLen:20 DgmLen:542 DF
                                    ***A**** Seq: 0x26B83575  Ack: 0x7AAE8D12  Win: 0x1FFE  TcpLen: 20
                                    [Xref => http://doc.emergingthreats.net/2002157]
                                    
                                    [**] [1:2002157:10] ET POLICY Skype User-Agent detected [**]
                                    [Classification: Potential Corporate Privacy Violation] [Priority: 1] 
                                    07/10-05:26:57.597973 MYIP:14580 -> 78.141.177.158:80
                                    TCP TTL:52 TOS:0x0 ID:13728 IpLen:20 DgmLen:538 DF
                                    ***AP*** Seq: 0xB70BDB31  Ack: 0x989F230F  Win: 0x1FFE  TcpLen: 20
                                    [Xref => http://doc.emergingthreats.net/2002157]
                                    
                                    [**] [1:2002157:10] ET POLICY Skype User-Agent detected [**]
                                    [Classification: Potential Corporate Privacy Violation] [Priority: 1] 
                                    07/10-05:26:57.747503 MYIP:62744 -> 92.122.50.146:80
                                    TCP TTL:55 TOS:0x0 ID:57600 IpLen:20 DgmLen:570 DF
                                    ***A**** Seq: 0x9C4E1C36  Ack: 0x4B26A476  Win: 0x3CC0  TcpLen: 32
                                    [Xref => http://doc.emergingthreats.net/2002157]
                                    
                                    [**] [1:2406417:287] ET RBN Known Russian Business Network IP UDP (209) [**]
                                    [Classification: Misc Attack] [Priority: 2] 
                                    07/10-05:27:01.426947 46.21.146.190:51413 -> MYIP:64284
                                    UDP TTL:52 TOS:0x0 ID:0 IpLen:20 DgmLen:58 DF
                                    Len: 30
                                    [Xref => http://doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork]
                                    
                                    [**] [1:2406823:287] ET RBN Known Russian Business Network IP UDP (412) [**]
                                    [Classification: Misc Attack] [Priority: 2] 
                                    07/10-05:27:14.971087 89.248.163.5:53340 -> MYIP:60685
                                    UDP TTL:117 TOS:0x0 ID:6851 IpLen:20 DgmLen:58
                                    Len: 30
                                    [Xref => http://doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork]
                                    
                                    [**] [1:2520104:1165] ET TOR Known Tor Exit Node TCP Traffic (53) [**]
                                    [Classification: Misc Attack] [Priority: 2] 
                                    07/10-05:28:31.199256 77.247.181.165:50103 -> MYIP:64284
                                    TCP TTL:50 TOS:0x0 ID:48027 IpLen:20 DgmLen:52 DF
                                    ******S* Seq: 0x85AA7429  Ack: 0x0  Win: 0x16D0  TcpLen: 32
                                    TCP Options (6) => MSS: 1460 NOP NOP SackOK NOP WS: 10 
                                    [Xref => http://doc.emergingthreats.net/bin/view/Main/TorRules]
                                    
                                    
                                    1 Reply Last reply Reply Quote 0
                                    • F
                                      Fesoj
                                      last edited by Jul 10, 2012, 4:20 PM Jul 10, 2012, 4:19 PM

                                      Alert Descriptions are shown on the alerts page, but not on blocked.

                                      ditto.

                                      Nevertheless, with some emerging threats rules enabled, my pfsense system is snorting (snort 2.9.2.3 pkg v. 2.3.0).

                                      1 Reply Last reply Reply Quote 0
                                      • 1
                                        10101000
                                        last edited by Jul 11, 2012, 5:46 AM

                                        Thanks Ermal,

                                        I presume that those with blank alerts have enabled FULL alert descriptions. The only problem that I can find at first glance is that "$pconfig['snortalertlogtype']" is not declared. This patch solves the problem.

                                        --- /usr/local/www/snort/snort_blocked.php.broken	2012-07-10 23:01:18.000000000 -0600
                                        +++ /usr/local/www/snort/snort_blocked.php	2012-07-10 23:27:11.000000000 -0600
                                        @@ -38,6 +38,7 @@
                                        
                                         $pconfig['brefresh'] = $config['installedpackages']['snortglobal']['alertsblocks']['brefresh'];
                                         $pconfig['blertnumber'] = $config['installedpackages']['snortglobal']['alertsblocks']['blertnumber'];
                                        +$pconfig['snortalertlogtype'] = $config['installedpackages']['snortglobal']['snortalertlogtype'];
                                        
                                         if (empty($pconfig['blertnumber']))
                                         	$bnentries = '500';
                                        
                                        

                                        Sincerely,

                                        10101000

                                        snort_blocked_2.3.0_patch.txt

                                        1 Reply Last reply Reply Quote 0
                                        • M
                                          miles267
                                          last edited by Jul 13, 2012, 12:00 PM

                                          What is the fix to get Alert Descriptions to properly display on the BLOCKED tab?  ALERTS tab is populated, but BLOCKED tab should be showing an Alert Description adjacent to each blocked IP vs blank or NA.

                                          1 Reply Last reply Reply Quote 0
                                          36 out of 42
                                          • First post
                                            36/42
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received