Snort and Interface Enable/Disable

Supermule

Will do! Very busy at ATM!

eri--

Package of snort has been update with changes proposed.
If you would like to test just reinstall snort.

Supermule

YOU are the CHAMP Ermal!!

Supermule

I get this error….

Snort_error.jpg_thumb

Supermule

More errors….I uninstalled package and reinstalled to see if it fixed the unicode error reported in the previous post.

It resulted in this...

Stuck on auto-enabling flowbits and error line 375 in /usr/local/pkg/snort/snort_check_for_rule_updates.php on line 375

Snort_error_2.jpg_thumb

AhnHEL

Have you gotten past this error yet, Super?

I'm still running Bill's code without any errors and now that the actual Snort package has been updated, I'm reluctant to upgrade if its going to be a showstopper.

I think a new thread should be started with the appropriate Testing Snort 2.9.2.3 pkg v. 2.5.3 as a title.

Supermule

I deleted the package completely and installed again.

The unicode error went away and SSL_State emerged.

I checked the SSL_State preprocessor and it runs fine! Without the checkbox checked, it crashes…

Supermule

Updated the package to 2.5.3 via Webgui and gets the unicode map file error again!!!!!!

So basically have to do a manual uninstall and install again since it apparently is not able to update the package.

Not good…. Something is wrong in the package building section of events.

Production remains on 2.5.2 until this is resolved.

Supermule

DONT UPGRADE THE PACKAGE TO 2.5.3!!!!!!!!!!!!!!!!!!!!

Even a fresh install triggers the rule_updates.php error!!!

So currently running the testbox WITHOUT snort….!

fatal_error.jpg_thumb

eri--

Reinstall resolved the issue

Supermule

Have you changed it Ermal???

Both reinstall and fresh install is not working!

bmeeks

The error in the Updates tab is due to a small change made to preface all the new function names in the code with "snort_". Ermal patched these up just before release to add the prefix, and it looks like one call in the UPDATES tab code got missed. It's looking for the old function name of "build_sig_msg_map()" instead of the patched up name of "snort_build_sid_msg_map()".

It's an easy fix, and hopefully Ermal can push it out shortly.

Bill

Supermule

Thanks Bill!!

eri--

Yes i fixed but it takes about 30 minutes for the package code to sync.

KeltecRFB

Thanks all for fixing the update error, I will fix it tonight when I get home.