Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort 2.9.5.5 pkg v3.0.1 Update – Minor bug fixes

    Scheduled Pinned Locked Moved pfSense Packages
    65 Posts 11 Posters 18.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      Supermule Banned
      last edited by

      As said….not an issue on 2.0.3 for me.

      1 Reply Last reply Reply Quote 0
      • bmeeksB
        bmeeks
        last edited by

        @fragged:

        On a closer look no matter how I arrange by date, it's always backwards for 2014 vs 2013. Must be a bug in the sorting piece of code or something.

        I checked on my production firewall and indeed the default sort appears to be putting the December 31, 2013 events above the January 2014 events.  However, you can click the DATE column header on the Alerts tab and sort the alerts so the January 01, 2014 events are at the top.  See the screenshot below showing the sorted list.  This is from a 2.1-RELEASE pfSense firewall.

        Bill

        Alerts_2014.jpg
        Alerts_2014.jpg_thumb

        1 Reply Last reply Reply Quote 0
        • S
          Supermule Banned
          last edited by

          On 2.0.3 it seems fine Bill.

          snort_alert_widget_sorting.jpg
          snort_alert_widget_sorting.jpg_thumb

          1 Reply Last reply Reply Quote 0
          • bmeeksB
            bmeeks
            last edited by

            @Supermule:

            On 2.0.3 it seems fine Bill.

            OK.  I just edited/replaced my original reply above with updated info.  I will check the Dashboard Widget next on 2.1.

            Bill

            1 Reply Last reply Reply Quote 0
            • bmeeksB
              bmeeks
              last edited by

              OK, found a "sort of fix" for the Snort Alerts Dashboard Widget.  It keys off the "sort setting" for the System Log.  If you have your system log entries displaying in reverse order, then the Snort Alerts Widget sorts the same way.  If you toggle System Log entries to display in "normal order", then the Snort Alerts Widget sorts correctly.

              The problem here is, I think, in the sorting logic of the System Log.  When toggled to display in "reverse" (that is, newest entries displayed first), it sorts the leading zero improperly in the timestamp.  The same problem is copied over into the Snort Widget code by the original author.

              Bill

              1 Reply Last reply Reply Quote 0
              • S
                Supermule Banned
                last edited by

                The log in Snort on the alerts table has the problem even on 2.0.3.

                The widget doesnt.

                1 Reply Last reply Reply Quote 0
                • bmeeksB
                  bmeeks
                  last edited by

                  @Supermule:

                  The log in Snort on the alerts table has the problem even on 2.0.3.

                  The widget doesnt.

                  Fixing the sorting will take a little extra magic to handle the leading zero or one in the months.  Sorting as a plain string won't work.  I will see if I can make it smarter.

                  Bill

                  1 Reply Last reply Reply Quote 0
                  • bmeeksB
                    bmeeks
                    last edited by

                    Fixing the sort turned out to be easier than I thought it would.  I fixed both the ALERTS tab display and the Snort Alerts Widget.  Let me test a wee bit more to be sure there are no unintended consequences from the fixes, then I will submit a Pull Request for a minor update to the Snort package and the Dashboard Alerts Widget.

                    Bill

                    1 Reply Last reply Reply Quote 0
                    • S
                      Supermule Banned
                      last edited by

                      When doing so Bill, cant you try to import the code from the traffic graph widgets since they have an interval function built in to update the Snort alert widget without refreshing the whole page…

                      1 Reply Last reply Reply Quote 0
                      • bmeeksB
                        bmeeks
                        last edited by

                        @Supermule:

                        When doing so Bill, cant you try to import the code from the traffic graph widgets since they have an interval function built in to update the Snort alert widget without refreshing the whole page…

                        Well, it's too late for this Widget fix.  Ermal merged the update this morning.  The current widget should be updating every 22 seconds if I understand the code correctly.  I think jimp originally wrote it.  His name is in the copyright info at the top of the source code.

                        There also may be a problem with the older 2.0.3 pfSense code with respect to JavaScript callbacks for the active refresh.  Not sure, though.  I will test on my 2.1 install to see if it auto-refreshes the Snort Alerts frame.

                        Bill

                        1 Reply Last reply Reply Quote 0
                        • bmeeksB
                          bmeeks
                          last edited by

                          @fragged:

                          Snort Alerts list doesn't show entries from 1.1.2014 at the top. When clicking on the Date column to sort by date, the alerts from today show up at the top again. Bug or by design?

                          This should be fixed in an update posted today (January 2, 2014).  The update was very minor and so I did not bump the package version number.  Hence no update will show in the Installed Packages tab.  Nonetheless, if you click the XML icon there to reinstall the package GUI components, you will get the updated PHP code for the Alerts tab.

                          Bill

                          1 Reply Last reply Reply Quote 0
                          • S
                            Supermule Banned
                            last edited by

                            It doesnt update automagically every 22 seconds Bill on 2.0.3.

                            I havent got a 2.1 box yet hence all the issues :D

                            1 Reply Last reply Reply Quote 0
                            • bmeeksB
                              bmeeks
                              last edited by

                              @Supermule:

                              It doesnt update automagically every 22 seconds Bill on 2.0.3.

                              I havent got a 2.1 box yet hence all the issues :D

                              I will test this out in my VMware environment to see if it works properly on 2.1.  If not, I will have to get up with jimp to see about a fix.

                              Bill

                              1 Reply Last reply Reply Quote 0
                              • S
                                Supermule Banned
                                last edited by

                                Thumbs up mate!!

                                1 Reply Last reply Reply Quote 0
                                • F
                                  fragged
                                  last edited by

                                  Thanks for the fix!

                                  Edit:

                                  For a future release, could you look into what Barnyard 2 spams to the system log? I love how Ermal (?) stripped the Snort log entries to bare minimal way back when, but Barnyard 2 still spams a good 100+ entries on Snort restart.

                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    jasonlitka
                                    last edited by

                                    I'm having a few issues with the 2.9.5.5 builds.

                                    First, it seems that on the WAN interface, the "Kill States" option, when used in conjunction with "Both" for Which IP to Block, results in all WAN states being dumped any time something is blocked, even though the WAN IP is part of the default whitelist.

                                    ~~Second, something is causing the firewall rules to reload fairly frequently as nothing stays in the Snort blocklist for more than 30 seconds (which results in issue #1 basically killing off my connection every minute or two) even though the setting is set to 1 hour.

                                    Third, I just tried to disable the "Kill States" option and restart Snort and now it won't come back up.  The start button in the UI never turns green and each time I click it I get a new 'snort' process which burns an entire CPU core.  Turning Kill States back on doesn't remedy the issue.  The system logs show:

                                    Jan 2 12:26:03	php: /snort/snort_interfaces.php: [Snort] Snort START for Verizon FIOS(igb3)…
                                    Jan 2 12:26:01	php: /snort/snort_interfaces.php: [Snort] Building new sig-msg.map file for WAN…
                                    Jan 2 12:26:00	php: /snort/snort_interfaces.php: [Snort] Enabling any flowbit-required rules for: WAN…
                                    Jan 2 12:25:47	php: /snort/snort_interfaces.php: [Snort] Updating rules configuration for: WAN …
                                    Jan 2 12:25:47	php: /snort/snort_interfaces.php: Toggle (snort starting) for WAN(Verizon FIOS)...
                                    ```~~
                                    
                                    EDIT: Rebooted and the 2nd & 3rd issues went away.  Still have the first problems though.

                                    I can break anything.

                                    1 Reply Last reply Reply Quote 0
                                    • bmeeksB
                                      bmeeks
                                      last edited by

                                      @fragged:

                                      Thanks for the fix!

                                      Edit:

                                      For a future release, could you look into what Barnyard 2 spams to the system log? I love how Ermal (?) stripped the Snort log entries to bare minimal way back when, but Barnyard 2 still spams a good 100+ entries on Snort restart.

                                      Yeah, I will take a look at Barnyard2.  I hate the log spamming as well.  I've been waiting for the latest beta version to make it to production and get updated in Fresh Ports.  Supposedly the new beta can do a soft restart and re-read the configuration file similar to the way Snort does it.  That would mean you could update Barnyard2 settings without actually stopping and restarting the daemon.

                                      Bill

                                      1 Reply Last reply Reply Quote 0
                                      • bmeeksB
                                        bmeeks
                                        last edited by

                                        @Jason:

                                        I'm having a few issues with the 2.9.5.5 builds.

                                        First, it seems that on the WAN interface, the "Kill States" option, when used in conjunction with "Both" for Which IP to Block, results in all WAN states being dumped any time something is blocked, even though the WAN IP is part of the default whitelist.

                                        Are you sure this is isolated to just the 2.9.5.5 binary build?  I'm asking because nothing was changed in the blocking part of Snort with the new binary version.  That code has been static since at least 2.9.4.1 of the Snort binary.  I'm talking about the Spoink plugin that inserts IP addresses into the snort2c table in the pf engine.

                                        Bill

                                        1 Reply Last reply Reply Quote 0
                                        • D
                                          DickB
                                          last edited by

                                          And if it is possible to make add a selection for the date format then that would make me very happy.
                                          For me the MM/DD/YY format is very illogical. I prefer DD/MM/YY (or YY/MM/DD). Then I don't think it's 2 Feb. today  ;)
                                          I know this may be confusing with the other logs, so maybe I should put in a request for a common pfSense selection for the date format.

                                          Dick

                                          1 Reply Last reply Reply Quote 0
                                          • J
                                            jasonlitka
                                            last edited by

                                            @bmeeks:

                                            @Jason:

                                            I'm having a few issues with the 2.9.5.5 builds.

                                            First, it seems that on the WAN interface, the "Kill States" option, when used in conjunction with "Both" for Which IP to Block, results in all WAN states being dumped any time something is blocked, even though the WAN IP is part of the default whitelist.

                                            Are you sure this is isolated to just the 2.9.5.5 binary build?  I'm asking because nothing was changed in the blocking part of Snort with the new binary version.  That code has been static since at least 2.9.4.1 of the Snort binary.  I'm talking about the Spoink plugin that inserts IP addresses into the snort2c table in the pf engine.

                                            Bill

                                            No, I'm not sure about that.  I wasn't using it prior to 2.9.4.6 and on that build I wasn't using many rules.

                                            I can break anything.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.