Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort 2.9.2.3 pkg v. 2.4.2 Issues

    Scheduled Pinned Locked Moved pfSense Packages
    116 Posts 19 Posters 33.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      dwood
      last edited by

      Ermal, on AMD64, 2.0.1 (this time a reinstall of 2.4.2 instead of the usual "clean" install I've been doing):

      1. Alert descriptions are back visible on blocked IP

      2.  2nd Interface alerts can now be cleared..and the interface is now staying active when selected.

      3.  Love the new categories (select all) and add to suppress features.

      4.  Issue with 2nd interface stopping after reboot is still there.```
      Jul 15 20:52:03 snort[35121]: FATAL ERROR: Unable to load pf args: Interrupted system call

      
This is going on with two seperate installations, both AMD64, 2.0.1

Awesome work sir.  I am sending $$$ your way.

Cheers,
Dennis.
      1 Reply Last reply Reply Quote 0
      • T
        tester_02
        last edited by

        @ermal:

        BTW, where are my donations?

        For those who want to donate please go to http://www.pfsense.org/index.php?option=com_content&task=view&id=47&Itemid=77

        Done..  It's been a while so feeling bad about it.  Best home router ever!

        Hoping people who use it for business contribute a lot more than me.

        1 Reply Last reply Reply Quote 0
        • 1
          10101000
          last edited by

          @ermal:

          BTW, where are my donations?

          For those who want to donate please go to http://www.pfsense.org/index.php?option=com_content&task=view&id=47&Itemid=77

          So far, so good. I've sent a donation your way and look forward to future improvements.

          Thanks

          1 Reply Last reply Reply Quote 0
          • E
            eri--
            last edited by

            Should be fixed the other issues.

            1 Reply Last reply Reply Quote 0
            • E
              eri--
              last edited by

              @dwood:

              Ermal, on AMD64, 2.0.1 (this time a reinstall of 2.4.2 instead of the usual "clean" install I've been doing):

              4.  Issue with 2nd interface stopping after reboot is still there.```
              Jul 15 20:52:03 snort[35121]: FATAL ERROR: Unable to load pf args: Interrupted system call

              Just make sure you reinstall the snort binary again.
              Usually that comes up from snort reloading and that should be fixed on new binary.

              This is going on with two seperate installations, both AMD64, 2.0.1

              Awesome work sir.  I am sending $$$ your way.

              Cheers,
              Dennis.

              Thank you for the contributions.

              1 Reply Last reply Reply Quote 0
              • F
                fragged
                last edited by

                Snort won't start if I disable "Sensitive data" preproc

                
Jul 16 10:32:22 	snort[3755]: FATAL ERROR: /usr/local/etc/snort/preproc_rules/sensitive-data.rules(1) Unknown rule option: 'sd_pattern'.
Jul 16 10:32:22 	snort[3755]: FATAL ERROR: /usr/local/etc/snort/preproc_rules/sensitive-data.rules(1) Unknown rule option: 'sd_pattern'.
                1 Reply Last reply Reply Quote 0
                • H
                  HOD
                  last edited by

                  @ermal:

                  @HOD:

                  I did a complete reinstall of snort (10min ago) and i have the same error of my last post.

                  snort[23088]: FATAL ERROR: s2c_parse_load_wl() => Invalid data in whitelist file: Invalid argument

                  @ermal:

                  For all the others having issues with blocking please whenever you have system log of 'unable to parse', get the file under the /usr/local/etc/snort/snort_$iface*/$whitelistname and post it here.

                  cat /usr/local/etc/snort/snort_18407_pppoe0/whitlsit
                  suppress gen_id 119, sig_id 2
                  suppress gen_id 119, sig_id 31
                  suppress gen_id 119, sig_id 32
                  suppress gen_id 120, sig_id 3
                  suppress gen_id 120, sig_id 6
                  suppress gen_id 120, sig_id 8
                  suppress gen_id 120, sig_id 10
                  suppress gen_id 122, sig_id 26
                  suppress gen_id 137, sig_id 1

                  greetz HOD

                  EDIT: my System 2.0.1-RELEASE (amd64) Snort 2.9.2.3 pkg v. 2.4.2

                  This should have been fixed also.
                  HOD can yo uconfirm that you have the same name for the suppress and whitelist selected?

                  Confirm it was the same name. Thx for fixing this.

                  @fragged:

                  Snort won't start if I disable "Sensitive data" preproc

                  
Jul 16 10:32:22 	snort[3755]: FATAL ERROR: /usr/local/etc/snort/preproc_rules/sensitive-data.rules(1) Unknown rule option: 'sd_pattern'.
Jul 16 10:32:22 	snort[3755]: FATAL ERROR: /usr/local/etc/snort/preproc_rules/sensitive-data.rules(1) Unknown rule option: 'sd_pattern'.

                  I got the same error.

                  1 Reply Last reply Reply Quote 0
                  • E
                    eri--
                    last edited by

                    @fragged:

                    Snort won't start if I disable "Sensitive data" preproc

                    
Jul 16 10:32:22 	snort[3755]: FATAL ERROR: /usr/local/etc/snort/preproc_rules/sensitive-data.rules(1) Unknown rule option: 'sd_pattern'.
Jul 16 10:32:22 	snort[3755]: FATAL ERROR: /usr/local/etc/snort/preproc_rules/sensitive-data.rules(1) Unknown rule option: 'sd_pattern'.

                    Fixed.

                    1 Reply Last reply Reply Quote 0
                    • C
                      Cino
                      last edited by

                      Nice work Ermal! I see IPv6 interface IPs are added and you change the whitelist to use Aliases.. Nice touch!!

                      Alert page looks really sharp, nanosec are gone :-) oh, and custom rules? That should be interesting… I'll play with that in a couple of weeks.

                      was about to report the sensitive data issue but you fixed it ;-)

                      thank you again..

                      FYI, when I fully uninstall, here is what is left over:

                      
/tmp/snort.info
/tmp/snort_update.log
/usr/local/lib/snort/dynamicengine
/usr/local/lib/snort/dynamicrules/bad-traffic.so
/usr/local/lib/snort/dynamicrules/web-iis.so
/usr/local/lib/snort/dynamicrules/web-client.so
/usr/local/lib/snort/dynamicrules/web-activex.so
/usr/local/lib/snort/dynamicrules/specific-threats.so
/usr/local/lib/snort/dynamicrules/snmp.so
/usr/local/lib/snort/dynamicrules/smtp.so
/usr/local/lib/snort/dynamicrules/p2p.so
/usr/local/lib/snort/dynamicrules/nntp.so
/usr/local/lib/snort/dynamicrules/netbios.so
/usr/local/lib/snort/dynamicrules/multimedia.so
/usr/local/lib/snort/dynamicrules/misc.so
/usr/local/lib/snort/dynamicrules/imap.so
/usr/local/lib/snort/dynamicrules/icmp.so
/usr/local/lib/snort/dynamicrules/exploit.so
/usr/local/lib/snort/dynamicrules/dos.so
/usr/local/lib/snort/dynamicrules/chat.so
/usr/local/lib/snort/dynamicrules/web-misc.so
/usr/local/lib/snort/dynamicrules
/usr/local/lib/snort/dynamic_preproc
/usr/local/lib/snort/dynamicpreprocessor
/usr/local/lib/snort
rm: /usr/local/lib/snort/dynamicengine: No such file or directory
rm: /usr/local/lib/snort/dynamicrules: No such file or directory
rm: /usr/local/lib/snort/dynamicrules/bad-traffic.so: No such file or directory
rm: /usr/local/lib/snort/dynamicrules/web-iis.so: No such file or directory
rm: /usr/local/lib/snort/dynamicrules/web-client.so: No such file or directory
rm: /usr/local/lib/snort/dynamicrules/web-activex.so: No such file or directory
rm: /usr/local/lib/snort/dynamicrules/specific-threats.so: No such file or directory
rm: /usr/local/lib/snort/dynamicrules/snmp.so: No such file or directory
rm: /usr/local/lib/snort/dynamicrules/smtp.so: No such file or directory
rm: /usr/local/lib/snort/dynamicrules/p2p.so: No such file or directory
rm: /usr/local/lib/snort/dynamicrules/nntp.so: No such file or directory
rm: /usr/local/lib/snort/dynamicrules/netbios.so: No such file or directory
rm: /usr/local/lib/snort/dynamicrules/multimedia.so: No such file or directory
rm: /usr/local/lib/snort/dynamicrules/misc.so: No such file or directory
rm: /usr/local/lib/snort/dynamicrules/imap.so: No such file or directory
rm: /usr/local/lib/snort/dynamicrules/icmp.so: No such file or directory
rm: /usr/local/lib/snort/dynamicrules/exploit.so: No such file or directory
rm: /usr/local/lib/snort/dynamicrules/dos.so: No such file or directory
rm: /usr/local/lib/snort/dynamicrules/chat.so: No such file or directory
rm: /usr/local/lib/snort/dynamicrules/web-misc.so: No such file or directory
rm: /usr/local/lib/snort/dynamic_preproc: No such file or directory
rm: /usr/local/lib/snort/dynamicpreprocessor: No such file or directory
/usr/local/share/examples/snort
/usr/local/share/licenses/snort-2.9.2.3
/usr/local/include/snort/dynamic_preproc
/usr/local/include/snort
rm: /usr/local/include/snort/dynamic_preproc: No such file or directory
/usr/local/src/snort_dynamicsrc
/var/db/pbi/.hashqueue/snort-2.9.2.3-i386
                      1 Reply Last reply Reply Quote 0
                      • J
                        judex
                        last edited by

                        It is not fixed for my 2.0.1 system. I deleted the package an every file with snort in its name before reinstallation.
                        Still the same warning in 2.5.0

                        2.1-RELEASE (amd64)
                        built on Wed Sep 11 18:17:48 EDT 2013
                        FreeBSD 8.3-RELEASE-p11

                        1 Reply Last reply Reply Quote 0
                        • C
                          Cino
                          last edited by

                          @judex:

                          It is not fixed for my 2.0.1 system. I deleted the package an every file with snort in its name before reinstallation.
                          Still the same warning in 2.5.0

                          did you reinstall?

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.