Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort update coming soon – please read about an important change!

    Scheduled Pinned Locked Moved pfSense Packages
    142 Posts 33 Posters 53.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      chrissl
      last edited by

      Should work now.

      Package is available amd64

      Edit:

      sorry.. I'n in a ipv6 network at the moment and can see it -.-'

      1 Reply Last reply Reply Quote 0
      • P
        Pummel
        last edited by

        i386 file is still missing and I still cannot get amd64. People using IPv6 seem to be able to access it though.

        1 Reply Last reply Reply Quote 0
        • C
          chrissl
          last edited by

          here i have uploaded the amd64 version.

          But i have no idea how i/you can install it manually :(

          snort-2.9.6.0-amd64.zip

          1 Reply Last reply Reply Quote 0
          • I
            iccws
            last edited by

            @chrissl:

            here i have uploaded the amd64 version.

            But i have no idea how i/you can install it manually :(

            snort-2.9.6.0-amd64.zip

            pkg_add

            1 Reply Last reply Reply Quote 0
            • D
              drew134
              last edited by

              I tried downloading the correct pbi file using an IPV6 proxy: http://www.ipv6proxy.net/go.php?u=https%3A%2F%2Ffiles.pfsense.org%2Fpackages%2F8%2FAll%2F&b=0&f=norefer

              I can get the file, uploaded to my own hosting service and tried a pkg_add -r in the command prompt and got the following error.

              tar: Failed to set default locale
              pkg_add: unable to open table of contents file '+CONTENTS' - not a package?

              So there's that… just in case anyone knows any more than I know to try.

              1 Reply Last reply Reply Quote 0
              • P
                Pummel
                last edited by

                @drew134:

                I tried downloading the correct pbi file using an IPV6 proxy: http://www.ipv6proxy.net/go.php?u=https%3A%2F%2Ffiles.pfsense.org%2Fpackages%2F8%2FAll%2F&b=0&f=norefer

                I can get the file, uploaded to my own hosting service and tried a pkg_add -r in the command prompt and got the following error.

                tar: Failed to set default locale
                pkg_add: unable to open table of contents file '+CONTENTS' - not a package?

                So there's that… just in case anyone knows any more than I know to try.

                Do you have the i386 or amd64 version of pfSense installed? that link points to i386 use http://www.ipv6proxy.net/go.php?u=https%3A%2F%2Ffiles.pfsense.org%2Fpackages%2Famd64%2F8%2FAll%2F&b=1 to get amd64

                1 Reply Last reply Reply Quote 0
                • D
                  drew134
                  last edited by

                  @Pummel:

                  @drew134:

                  I tried downloading the correct pbi file using an IPV6 proxy: http://www.ipv6proxy.net/go.php?u=https%3A%2F%2Ffiles.pfsense.org%2Fpackages%2F8%2FAll%2F&b=0&f=norefer

                  I can get the file, uploaded to my own hosting service and tried a pkg_add -r in the command prompt and got the following error.

                  tar: Failed to set default locale
                  pkg_add: unable to open table of contents file '+CONTENTS' - not a package?

                  So there's that… just in case anyone knows any more than I know to try.

                  Do you have the i386 or amd64 version of pfSense installed? that link points to i386 use http://www.ipv6proxy.net/go.php?u=https%3A%2F%2Ffiles.pfsense.org%2Fpackages%2Famd64%2F8%2FAll%2F&b=1 to get amd64

                  I actually have the i386 version. Thank you for noticing and adding that.

                  1 Reply Last reply Reply Quote 0
                  • J
                    JStyleG7X
                    last edited by

                    I've made TinyURL links from the ipv6proxy page you listed, my pfSense box seemed to like that better.

                    I'm not an expert at installing these but from what I read the process should be as follows (please correct any mistakes)…

                    1.) SSH into your pfSense box
                    2.) Choose option 8
                    3.) I believe you need to run the .pbi i386/amd64 link - copy and paste the correct link that corresponds to your system.

                    pkg_add -r http://tinyurl.com/ipv6-pfsense-i386/snort-2.9.6.0-i386.pbi
                    pkg_add -r http://tinyurl.com/ipv6-pfsense-i386/snort-2.9.6.0.tbz

                    pkg_add -r http://tinyurl.com/ipv6-pfsense-amd64/snort-2.9.6.0-amd64.pbi
                    pkg_add -r http://tinyurl.com/ipv6-pfsense-amd64/snort-2.9.6.0.tbz

                    4.) Type "rehash" and press enter
                    5.) Type "snort-2.9.6.0-amd64 -i" or "snort-2.9.6.0-i386 -i"

                    I based these instructions of of the following page, https://doc.pfsense.org/index.php/Installing_FreeBSD_Packages

                    UPDATE

                    It seems the links above might not work as I thought, the slash and file name are not being read correctly when it attempts to download, I did however recreate the links directly to the files.....but then the problem I had with this was the dependencies did not download correctly.

                    These are links to download the files directly from the working ipv6 mirror.

                    http://tinyurl.com/pfsensesnort-2-9-6-0-amd64-pbi
                    http://tinyurl.com/pfsensesnort-2-9-6-0-amd64-tbz

                    http://tinyurl.com/pfsense-snort-2-9-6-0-i386-pbi
                    http://tinyurl.com/pfsense-snort-2-9-6-0-i386-tbz

                    1 Reply Last reply Reply Quote 0
                    • D
                      drew134
                      last edited by

                      @JStyleG7X:

                      I've made TinyURL links from the ipv6proxy page you listed, my pfSense box seemed to like that better.

                      I'm not an expert at installing these but from what I read the process should be as follows (please correct any mistakes)…

                      1.) SSH into your pfSense box
                      2.) Choose option 8
                      3.) I believe you need to run the .pbi i386/amd64 link - copy and paste the correct link that corresponds to your system.

                      pkg_add -r http://tinyurl.com/ipv6-pfsense-i386/snort-2.9.6.0-i386.pbi
                      pkg_add -r http://tinyurl.com/ipv6-pfsense-i386/snort-2.9.6.0.tbz

                      pkg_add -r http://tinyurl.com/ipv6-pfsense-amd64/snort-2.9.6.0-amd64.pbi
                      pkg_add -r http://tinyurl.com/ipv6-pfsense-amd64/snort-2.9.6.0.tbz

                      4.) Type "rehash" and press enter
                      5.) Type "snort-2.9.6.0-amd64 -i" or "snort-2.9.6.0-i386 -i"

                      I based these instructions of of the following page, https://doc.pfsense.org/index.php/Installing_FreeBSD_Packages

                      I read a little bit about it earlier and I please correct me if I am wrong.  I believe the package manager actually uses an install script for packages.. it installs the services and then installs/creates the menu entries in the GUI.  I believe my only installing the PBI you create the service but not the GUI entries???  The package manager uses XML scripting or something along those lines.  Again,  please feel free to add on… the more we all know the better in the long run  :)

                      1 Reply Last reply Reply Quote 0
                      • J
                        JStyleG7X
                        last edited by

                        Yeah I read that too, https://forum.pfsense.org/index.php?topic=69370.0

                        Regardless I still wanted to try it anyway….I didn't get any farther though.

                        1 Reply Last reply Reply Quote 0
                        • C
                          cmb
                          last edited by

                          The file inconsistency is fixed, someone that moved DNS only moved the A and not the AAAA which left things inconsistent. I fixed it.

                          1 Reply Last reply Reply Quote 0
                          • D
                            drew134
                            last edited by

                            @cmb:

                            The file inconsistency is fixed, someone that moved DNS only moved the A and not the AAAA which left things inconsistent. I fixed it.

                            Confirmed here, downloading and installing.  Thank you!!!!!!  :) ;D :) ;D

                            1 Reply Last reply Reply Quote 0
                            • C
                              chrissl
                              last edited by

                              @drew134:

                              @cmb:

                              The file inconsistency is fixed, someone that moved DNS only moved the A and not the AAAA which left things inconsistent. I fixed it.

                              Confirmed here, downloading and installing.  Thank you!!!!!!  :) ;D :) ;D

                              Check. Thanks.

                              Im downloading now ;)

                              1 Reply Last reply Reply Quote 0
                              • K
                                kilthro
                                last edited by

                                Thanks for fixing!

                                1 Reply Last reply Reply Quote 0
                                • F
                                  foresthus
                                  last edited by

                                  @cmb:

                                  The file inconsistency is fixed, someone that moved DNS only moved the A and not the AAAA which left things inconsistent. I fixed it.

                                  THANX 4 fixing !!!  8) :)

                                  1 Reply Last reply Reply Quote 0
                                  • F
                                    fragged
                                    last edited by

                                    Snort package version was bumped because of the recent OpenSSL vulnerability by rbgarga. Snort has the package version number in a few other pages which haven't been touched to reflect the new 3.0.6 version number. Can someone from the core team please check the rest of the package to make sure the version number is consistent, thanks.

                                    1 Reply Last reply Reply Quote 0
                                    • R
                                      Ramosel
                                      last edited by

                                      Bill,
                                      Have not updated pfSense to 2.1.1 yet, Still on 2.1.  Updated Snort pkg this morning and installation dialog looked complete with success.  Now Snort will not start:

                                      snort[1683]: FATAL ERROR: /usr/pbi/snort-amd64/etc/snort/snort_34714_bge0/rules/snort.rules(9231) : pcre compile of "(obj.data|\object.data).+file\x3A\x2F\x2F127\x2E[0-9]" failed at offset 11 : missing opening brace after \o

                                      1 Reply Last reply Reply Quote 0
                                      • C
                                        Cino
                                        last edited by

                                        @Ramosel:

                                        Bill,
                                        Have not updated pfSense to 2.1.1 yet, Still on 2.1.  Updated Snort pkg this morning and installation dialog looked complete with success.  Now Snort will not start:

                                        snort[1683]: FATAL ERROR: /usr/pbi/snort-amd64/etc/snort/snort_34714_bge0/rules/snort.rules(9231) : pcre compile of "(obj.data|\object.data).+file\x3A\x2F\x2F127\x2E[0-9]" failed at offset 11 : missing opening brace after \o

                                        search is your friend, uncheck emerging-web_client.rules under Categories… I think the issue is with the ET rules itself and not snort

                                        1 Reply Last reply Reply Quote 0
                                        • R
                                          Ramosel
                                          last edited by

                                          @Cino:

                                          @Ramosel:

                                          Bill,
                                          Have not updated pfSense to 2.1.1 yet, Still on 2.1.  Updated Snort pkg this morning and installation dialog looked complete with success.  Now Snort will not start:

                                          snort[1683]: FATAL ERROR: /usr/pbi/snort-amd64/etc/snort/snort_34714_bge0/rules/snort.rules(9231) : pcre compile of "(obj.data|\object.data).+file\x3A\x2F\x2F127\x2E[0-9]" failed at offset 11 : missing opening brace after \o

                                          search is your friend, uncheck emerging-web_client.rules under Categories… I think the issue is with the ET rules itself and not snort

                                          Thank you!  That was it!  I did spend some time looking but guess I wasn't looking in the right direction.

                                          Odd, I always do a backup and reboot before I update anything and the previous version liked the rule but "this one" doesn't.  I say "this one" because all indications are that we've gone to 3.0.6 but the Services/Snort page is still showing 3.0.5 so I'm not sure which is true.

                                          Rick

                                          1 Reply Last reply Reply Quote 0
                                          • S
                                            Supermule Banned
                                            last edited by

                                            Thats not necessary on 2.0.3

                                            Just for your info. Emerging web client rules works fine.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.