Snort 2.9.4.6 pkg v2.6.0 Update
-
Thanks for the update!
Additional to upcoming binary update, would it be possible to make snort2c list persist through filter_reload? pfBlocker lists, aliases, etc. persist through it, why doesn't snort2c?
-
I'm on 2.5.9 and just upgraded to 2.1 on 32 bit. I have my block removal set to never remove, but I noticed several times that I have a large amount of alerts, but the blocked list gets reset frequently. I haven't powered down the box. Any suggestions? I plan on upgrading to 2.6 tonight, but just wondering if anyone else was experiencing this?
-
pfSense function filter_reload will clear the snort2c list, like mentioned on a gazillion threads since 2.1 was released :)
-
Thanks, so this is a bug I take it, or how is there something I can do to fix this? When I search the forums I only find 2 posts on the issue. Thanks.
-
Thanks, so this is a bug I take it, or how is there something I can do to fix this? When I search the forums I only find 2 posts on the issue. Thanks.
I don't think it is a bug in Snort so much as it is a change in behavior of 2.1 pfSense. I changed nothing in Snort relative to the blocking functions. In fact, those haven't changed in many, many months. Instead, 2.1 pfSense is doing something differently in regards to clearing the pf blocking tables.
I will investigate to see if there is anything I can do on the Snort side of things to cope with this.
Bill
-
Awesome. Thanks again for creating this package. It's a great one. What do you think will happen with Cisco's acquisition of Sourcefire? Do you think it will effect the availability or your package?
-
Awesome. Thanks again for creating this package. It's a great one. What do you think will happen with Cisco's acquisition of Sourcefire? Do you think it will effect the availability or your package?
I think the general feeling is the open-source Snort software and rules will survive despite the Cisco acquisition. But nobody really knows for sure but the Cisco bosses.
One minor correction. I did not create the Snort package on pfSense. That was the work of several others in the distant past. I just sort of became the default maintainer late in 2012 when I submitted some fixes and a few new features. Thanks for the kind words, though.
Bill
-
Thanks for the update!
Additional to upcoming binary update, would it be possible to make snort2c list persist through filter_reload? pfBlocker lists, aliases, etc. persist through it, why doesn't snort2c?
Aliases live in the config.xml file and might be reloaded on a filter reload call. Don't now for sure, though. I can look through the pfBlocker package code and see where it stores its block list and how it protects it.
Bill
-
Do you know roughly how often the filter_reload happens? Snort still blocks effectively correct, just allows the offending IP to attack again after the filter_reload happens?
-
Well - If the Cisco acquisition of SNORT effects things and 90% or so of the group goes with Cisco, then get a new group. Call it something else and continue on. SNIFF (TM) is a good name…
And if the band you're in starts playing different tunes...
-
Do you know roughly how often the filter_reload happens? Snort still blocks effectively correct, just allows the offending IP to attack again after the filter_reload happens?
No I don't, but I also don't think it is necessarily on a regularly scheduled basis. I really don't know much about that process. Guess I need to dig in and learn.
Bill
-
I get this when trying to upgrade a 2.0.3 box…
Beginning package installation for snort...
Downloading package configuration file... done.
Saving updated package information... done.
Downloading snort and its dependencies...
Checking for package installation...
Downloading http://files.pfsense.org/packages/8/All/barnyard2-1.12.tbz ... (extracting)Downloading http://files.pfsense.org/packages/8/All/mysql-client-5.5.33.tbz ... could not download from there or http://ftp2.FreeBSD.org/pub/FreeBSD/ports/i386/packages-8.1-release/All/mysql-client-5.5.33.tbz.
of barnyard2-1.12 failed!Installation aborted.Backing up libraries...
Removing package...
Starting package deletion for mysql-client-5.5.30...done.
Starting package deletion for barnyard2-1.12...done.
Starting package deletion for libnet11-1.1.6,1...done.
Skipping package deletion for libdnet-1.11_3 because it is a dependency.
Starting package deletion for libpcap-1.3.0...done.
Starting package deletion for daq-2.0.0...done.
Starting package deletion for snort-2.9.4.6...done.
Removing snort components...
Menu items... done.
Services... done.
Loading package instructions...
Include file snort.inc could not be found for inclusion.
Deinstall commands...
Not executing custom deinstall hook because an include is missing.
Removing package instructions...done.
Auxiliary files... done.
Package XML... done.
Configuration... done.
Cleaning up... Failed to install package.Installation halted.
-
Supermule, how much do you pay for your connection a month or do you work at an ISP? That speed is nuts.
-
:D That is what I offer to my clients in my VDI environment.
All sitting on 10Gbit backbone direct to the internet exchange :)
Supermule, how much do you pay for your connection a month or do you work at an ISP? That speed is nuts.
-
I get this when trying to upgrade a 2.0.3 box…
Beginning package installation for snort...
Downloading package configuration file... done.
Saving updated package information... done.
Downloading snort and its dependencies...
Checking for package installation...Downloading http://files.pfsense.org/packages/8/All/mysql-client-5.5.33.tbz ... could not download from there or http://ftp2.FreeBSD.org/pub/FreeBSD/ports/i386/packages-8.1-release/All/mysql-client-5.5.33.tbz.
of barnyard2-1.12 failed!...
Installation aborted.Backing up libraries...
Cleaning up... Failed to install package.Installation halted.
jimp mentioned in an e-mail exchange with me that the 2.0.3 package builders had some issues with updates to the Ports. That's why the rollout of the updated binary was delayed a bit. Looks like the builder used a newer MySQL client package (5.5.33 instead of 5.5.30) than what is specified in the pkg_config.8.xml file. I'll pass this along to jimp. He should be able to fix it up easy enough.
I looked at files.pfsense.org and MySQL client packages are there for 5.5.30, 5.5.32, and 5.5.34. But no version 5.5.33, so something must have gone weird with the package builder. The pfSense guys should be able to get it sorted out. I've sent a note to them alerting them of the issue.
Bill
-
Damn nice Bill!!
-
Pls. notify when package is ready to install :)
-
Pls. notify when package is ready to install :)
Got a reply back from jimp. He says it should be OK now. Give it a try and let me know if you still have problems.
Bill
-
Its running and blocking!!
THAAAAAAAAAAAAAAAAAANK YOU!! :-*
-
Its running and blocking!!
THAAAAAAAAAAAAAAAAAANK YOU!! :-*
OK! Thanks for the feedback.
There is one small bug uncovered thus far with the new FQDN Alias support. I worked that one with another user who successfully tested a fix. I will hold up pushing out that update while I wait to see if anything else surfaces. That bug is sort of minor and only affects folks using the FQDN Alias with a particular configuration.
Bill
