Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort can't download Snort VRT Rules [solved]

    Scheduled Pinned Locked Moved pfSense Packages
    25 Posts 9 Posters 19.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      Mr. Jingles
      last edited by

      @bmeeks:

      Yes, I can see about bringing back the old behavior.  But I also want to at least include a mechanism for resetting any forced rules back to their default state with "no color".  So that probably means another icon on the page.  I will try out some ideas.

      Bill

      Heros will remain Heros  ;D

      6 and a half billion people know that they are stupid, agressive, lower life forms.

      1 Reply Last reply Reply Quote 0
      • J
        jonna99
        last edited by

        Hi!
        I have been unable to download VRT-rules since July 10. I run three different machines, and one of them, with paid Subscriber rules, gets error code 422. The other two with free Registered User rules work fine.

        Jonna

        1 Reply Last reply Reply Quote 0
        • bmeeksB
          bmeeks
          last edited by

          @jonna99:

          Hi!
          I have been unable to download VRT-rules since July 10. I run three different machines, and one of them, with paid Subscriber rules, gets error code 422. The other two with free Registered User rules work fine.

          Jonna

          My paid VRT downloads still work.  Are you positive that your subscription is still current?  Just checking… ;).

          I had one failure of the paid VRT download during the window when the Snort group had web site issues, but since those were fixed several days ago I've not hand any other problems.

          Bill

          1 Reply Last reply Reply Quote 0
          • J
            jonna99
            last edited by

            Yes, thanks :-) it is paid for about another 6 months, so that shouldn´t be the problem. Tried un- and and reinstalling Snort-package, but no, doesn´t work.
            I read that there will be an upgrade to 2.9.6.1 soon so I guess I just have to wait and see if that will fix it.

            Jonna

            1 Reply Last reply Reply Quote 0
            • bmeeksB
              bmeeks
              last edited by

              @jonna99:

              Yes, thanks :-) it is paid for about another 6 months, so that shouldn´t be the problem. Tried un- and and reinstalling Snort-package, but no, doesn´t work.
              I read that there will be an upgrade to 2.9.6.1 soon so I guess I just have to wait and see if that will fix it.

              Jonna

              One other thing – try deleting and re-adding your Oink code on the paid rules box just in case it got corrupted.  And you do have two different Oink codes, I assume:  one for the paid subscription and another for the free registered user subscription.

              One other question -- are you using the current Snort 2.9.6.0 pkg v3.0.13 version?

              Bill

              1 Reply Last reply Reply Quote 0
              • J
                jonna99
                last edited by

                Yes, different Oink-codes. Works with free subscription but not with paid…I have sent a question to Snort.org but still haven´t got an answer. I guess it must have  to do with my subscription. We will see. And yes, 2.9.6.0 pkg v3.0.13 confirmed.
                Thanks for trying to help
                Jonna

                1 Reply Last reply Reply Quote 0
                • bmeeksB
                  bmeeks
                  last edited by

                  @jonna99:

                  Yes, different Oink-codes. Works with free subscription but not with paid…I have sent a question to Snort.org but still haven´t got an answer. I guess it must have  to do with my subscription. We will see. And yes, 2.9.6.0 pkg v3.0.13 confirmed.
                  Thanks for trying to help
                  Jonna

                  OK.  I really wonder if it might be something weird with your code.  Mine works, and so far as I know, most everyone else's here on the Forum works now or I would expect a ton of posts.  Post back with any update.

                  Bill

                  1 Reply Last reply Reply Quote 0
                  • J
                    jonna99
                    last edited by

                    Yes there was a problem with the paid account. After resetting and getting a new oink-code it works again.
                    Thanks again
                    Jonna

                    1 Reply Last reply Reply Quote 0
                    • P
                      propel
                      last edited by

                      Snort 2.9.6.2  pkg v3.1 is now available under package downloads

                      after I updated snort my VRT Rules downloaded.

                      1 Reply Last reply Reply Quote 0
                      • bmeeksB
                        bmeeks
                        last edited by

                        @propel:

                        Snort 2.9.6.2  pkg v3.1 is now available under package downloads

                        after I updated snort my VRT Rules downloaded.

                        The new version addresses the URL change at snort.org and also the older rules went EOL yesterday.

                        Bill

                        1 Reply Last reply Reply Quote 0
                        • T
                          thewellington
                          last edited by

                          How do I get the new version?  The only package available to me is 2.9.6.0 pkg v3.0.13

                          I don't seem to be able to use 2.9.6.3 via the gui.

                          1 Reply Last reply Reply Quote 0
                          • bmeeksB
                            bmeeks
                            last edited by

                            @thewellington:

                            How do I get the new version?  The only package available to me is 2.9.6.0 pkg v3.0.13

                            I don't seem to be able to use 2.9.6.3 via the gui.

                            This tells me you are probably running an older version of pfSense (like 2.0.x something).  Versions older than 2.1 are no longer supported as the underlying binary packages required for 2.0.x pfSense are no longer being built by the pfSense team.

                            If this is the case for you, then you need to upgrade to at least pfSense 2.1 or higher to use the latest Snort package.

                            Bill

                            1 Reply Last reply Reply Quote 0
                            • T
                              thewellington
                              last edited by

                              Yeah…  except that I am running 2.1.4 :(

                              This seems to be affecting both Netgate appliances I have... APU2 and a 7541

                              Bill

                              1 Reply Last reply Reply Quote 0
                              • bmeeksB
                                bmeeks
                                last edited by

                                @thewellington:

                                Yeah…  except that I am running 2.1.4 :(

                                This seems to be affecting both Netgate appliances I have... APU2 and a 7541

                                Bill

                                OK, the fact you have Netgate devices gives me a possible clue. I believe (but I don't know for sure) they may have a separate updates infrastructure for Netgate devices to maintain compatibility with their hardware.  If my guess is true, it may be their repository has not yet synchronized with the latest version.  If you have a support contract, give them this info and see if they can help.  If not, perhaps you can ping one of the pfSense developers who frequent this forum.

                                Bill

                                1 Reply Last reply Reply Quote 0
                                • Y
                                  ypmict
                                  last edited by

                                  Hi…
                                  I am also facing this problem, I am using :
                                  pfsense 2.0.1
                                  snort 2.9.6.2 pkg v3.1.4 (using the free oinkcode)

                                  the error log says :

                                  Starting rules update...  Time: 2014-11-10 10:33:28
                                  Downloading Snort VRT rules md5 file snortrules-snapshot-2923.tar.gz.md5...
                                  Snort VRT rules md5 download failed.
                                  Server returned error code 422.
                                  Server error message was:
                                  Snort VRT rules will not be updated.

                                  ...anyone know what the problem is?
                                  I also try to register different account for oinkcode.. but still shows error...
                                  thanks

                                  1 Reply Last reply Reply Quote 0
                                  • bmeeksB
                                    bmeeks
                                    last edited by

                                    @ypmict:

                                    Hi…
                                    I am also facing this problem, I am using :
                                    pfsense 2.0.1
                                    snort 2.9.6.2 pkg v3.1.4 (using the free oinkcode)

                                    the error log says :

                                    Starting rules update...  Time: 2014-11-10 10:33:28
                                    Downloading Snort VRT rules md5 file snortrules-snapshot-2923.tar.gz.md5...
                                    Snort VRT rules md5 download failed.
                                    Server returned error code 422.
                                    Server error message was:
                                    Snort VRT rules will not be updated.

                                    ...anyone know what the problem is?
                                    I also try to register different account for oinkcode.. but still shows error...
                                    thanks

                                    Snort is no longer supported on pfSense versions older than 2.1.  You say you are running 2.0.1, so Snort is now broken and unsupported on that version.  You should upgrade your pfSense to version 2.1.5.

                                    Bill

                                    1 Reply Last reply Reply Quote 0
                                    • First post
                                      Last post
                                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.