Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort wont start

    Scheduled Pinned Locked Moved pfSense Packages
    15 Posts 4 Posters 2.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M Offline
      maverick_slo
      last edited by

      Hi all!
      All of the sudden I get this error when I try to start snort:

      Aug 1 12:45:15 php: /snort/snort_interfaces.php: The command '/usr/local/bin/snort -R 10837 -D -q -l /var/log/snort/snort_em210837 –pid-path /var/run --nolock-pidfile -G 10837 -c /usr/pbi/snort-i386/etc/snort/snort_10837_em2/snort.conf -i em2' returned exit code '1', the output was ''

      Aug 1 12:45:15 snort[73626]: FATAL ERROR: /usr/pbi/snort-i386/etc/snort/snort_10837_em2/snort.conf(5) Failed to parse the IP address: [/,8.8.4.4,8.8.8.8,10.10.0.0/24,10.15.20.0/24,85.10.XX.X,85.10.XX.XX,92.37.XX.XX/32,127.0.0.1,172.16.16.0/24,192.168.100.0/24,212.18.XX.XX,212.18.XX.XX,2001:15c2:XXX:XXX::/64,2001:15c2:XXX:XXX::/64,2001:15c2:XXX:XXX::/64].

      Any idea what went wrong?
      I use latest package.

      1 Reply Last reply Reply Quote 0
      • S Offline
        Supermule Banned
        last edited by

        Can you try and disable IPv6 on the FW and restart the package?

        So HOMEnet in Snort only contain IPv4 addresses…

        1 Reply Last reply Reply Quote 0
        • BBcan177B Offline
          BBcan177 Moderator
          last edited by

          Maybe its an issue with the "Pass Lists"

          First create an "Alias" in the Firewall Tab and add the IPs there.

          Or you have an issue in the Snort Interface "Define Server (IP Variables)" section?

          "Experience is something you don't get until just after you need it."

          Website: http://pfBlockerNG.com
          Twitter: @BBcan177  #pfBlockerNG
          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

          1 Reply Last reply Reply Quote 0
          • M Offline
            maverick_slo
            last edited by

            lol reboot fixed it
            machine was up 33 days.
            lol windows syndrome

            1 Reply Last reply Reply Quote 0
            • bmeeksB Offline
              bmeeks
              last edited by

              @maverick_slo:

              Hi all!
              All of the sudden I get this error when I try to start snort:

              Aug 1 12:45:15 php: /snort/snort_interfaces.php: The command '/usr/local/bin/snort -R 10837 -D -q -l /var/log/snort/snort_em210837 –pid-path /var/run --nolock-pidfile -G 10837 -c /usr/pbi/snort-i386/etc/snort/snort_10837_em2/snort.conf -i em2' returned exit code '1', the output was ''

              Aug 1 12:45:15 snort[73626]: FATAL ERROR: /usr/pbi/snort-i386/etc/snort/snort_10837_em2/snort.conf(5) Failed to parse the IP address: [/,8.8.4.4,8.8.8.8,10.10.0.0/24,10.15.20.0/24,85.10.XX.X,85.10.XX.XX,92.37.XX.XX/32,127.0.0.1,172.16.16.0/24,192.168.100.0/24,212.18.XX.XX,212.18.XX.XX,2001:15c2:XXX:XXX::/64,2001:15c2:XXX:XXX::/64,2001:15c2:XXX:XXX::/64].

              Any idea what went wrong?
              I use latest package.

              That leading forward slash in the HOME_NET variable is the problem.  Don't know what IP should be there, but it did not get there.  I see that a reboot fixed the issue for you, though.

              Bill

              1 Reply Last reply Reply Quote 0
              • M Offline
                maverick_slo
                last edited by

                Yeah I know it was because of that slash :)
                I downed/upped ifaces but it was still there :)

                1 Reply Last reply Reply Quote 0
                • M Offline
                  maverick_slo
                  last edited by

                  Heh…
                  Same thing again on 2.2
                  If I reboot, all is OK.
                  Is it possible to mod the package to omit this "/" thing in IP address list?

                  Regards,
                  Mav

                  1 Reply Last reply Reply Quote 0
                  • bmeeksB Offline
                    bmeeks
                    last edited by

                    @maverick_slo:

                    Heh…
                    Same thing again on 2.2
                    If I reboot, all is OK.
                    Is it possible to mod the package to omit this "/" thing in IP address list?

                    Regards,
                    Mav

                    Would need to first know where it is coming from.  When you look at it during the "broken time", note where the slash is located.  Then after a reboot when it is working, note what IP address is located where the slash was.  Tell me what interface or function the IP address is associated with.  It's like maybe something is returning a null IP and subnet, but when the firewall is rebooted a valid IP and subnet is then returned.

                    Bill

                    1 Reply Last reply Reply Quote 0
                    • M Offline
                      maverick_slo
                      last edited by

                      Yeah I looked at that…
                      instead of slash there is nothing after reboot.
                      I comapred both listts before and after reboot and slash was added there... After reboot slash is gone....

                      1 Reply Last reply Reply Quote 0
                      • bmeeksB Offline
                        bmeeks
                        last edited by

                        @maverick_slo:

                        Yeah I looked at that…
                        instead of slash there is nothing after reboot.
                        I comapred both listts before and after reboot and slash was added there... After reboot slash is gone....

                        That limits my troubleshooting.  It would be helpful to have an idea what IP address is not there.  I can add some checks for empty strings and make sure they are not added to a PASS LIST or to HOME_NET.  I will put that on my bug list for a future update.

                        Bill

                        1 Reply Last reply Reply Quote 0
                        • M Offline
                          maverick_slo
                          last edited by

                          Thanks much appreciated.
                          This actually happens on 2 of my systems, both latest 2.2 release and both latest snort packages…

                          1 Reply Last reply Reply Quote 0
                          • bmeeksB Offline
                            bmeeks
                            last edited by

                            @maverick_slo:

                            Thanks much appreciated.
                            This actually happens on 2 of my systems, both latest 2.2 release and both latest snort packages…

                            I had a flash of inspiration.  Check that you don't perhaps have an Alias defined someplace in a PASS LIST that initially evaluates to an empty string.

                            Bill

                            1 Reply Last reply Reply Quote 0
                            • M Offline
                              maverick_slo
                              last edited by

                              Huh I only have 1 alias used in passlist and this one if full of IPs :)

                              1 Reply Last reply Reply Quote 0
                              • bmeeksB Offline
                                bmeeks
                                last edited by

                                I see some locations in the code of the function that generates the PASS LIST and HOME_NET variables where an empty string returned for an IP address and subnet bit length could result in simply a slash ( "/" ) getting written to the variable.  I will add some extra validation code in that function for the next release.

                                This is apparently a rare thing, and something in setup appears to be exposing it.

                                Bill

                                1 Reply Last reply Reply Quote 0
                                • bmeeksB Offline
                                  bmeeks
                                  last edited by

                                  I posted a Pull Request today that adds some additional validation checks on IP addresses and subnets when creating the HOME_NET and PASS LIST values for Snort.  Hopefully this corrects the issue with only a single forward slash ( "/" ) getting into HOME_NET and/or PASS LISTS.

                                  Here is a link to the Pull Request:  https://github.com/pfsense/pfsense-packages/pull/805

                                  Bill

                                  1 Reply Last reply Reply Quote 0
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.