Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Suricata & PPPoE Interfaces - Bug Reported to Openinfosecfoundation.org

    Scheduled Pinned Locked Moved IDS/IPS
    21 Posts 8 Posters 5.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • G
      gsiemon
      last edited by

      I'm fairly new to pfSense and was attracted to it because of its ability to allow relatively easy administration of Snort/Suricata type IDS/IPS.  I was going to try Suricata but my WAN interface uses PPPoE.  I have seen a few people that have had issues with PPPoE not working and some discussion that it was a problem with the Suricata binary.  I spent a bit of time looking through the Openinfosecfoundation.org Issues database and couldn't find where anyone had actually reported it as a bug.

      Last night I submitted a bug report:

      https://redmine.openinfosecfoundation.org/issues/1445

      Will let you know if/when it gets fixed.

      Greg

      1 Reply Last reply Reply Quote 0
      • W
        Wolf666
        last edited by

        It is a limit of Suricata binaries
        https://forum.pfsense.org/index.php?topic=78062.msg461952#msg461952

        Modem Draytek Vigor 130
        pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
        Switch Cisco SG350-10
        AP Netgear R7000 (Stock FW)
        HTPC Intel NUC5i3RYH
        NAS Synology DS1515+
        NAS Synology DS213+

        1 Reply Last reply Reply Quote 0
        • G
          gsiemon
          last edited by

          Indeed it is and that's why I have logged an official bug report.  Openinfosecfoundation.org is the Suricata developer.  While there has been a lot of discussion here, no one seems to have logged it with them.  Within 24 hours of logging the bug they have already generated a patch and I am working with @BMeeks to test it.  Hopefully have some more news in the next few days.

          1 Reply Last reply Reply Quote 0
          • bmeeksB
            bmeeks
            last edited by

            A patch was submitted to Github.  Unfortunately it was for the 2.1-BETA code base and not the 2.0.x production tree of Suricata we use in pfSense.  That will slow down my getting something ready for @gsiemon to test for me.  I will get it done, though.  I know a lot of folks want PPPoE support in Suricata.

            Bill

            1 Reply Last reply Reply Quote 0
            • M
              mauritsl
              last edited by

              Here a PPPOE user too, When can the general public use it?

              Best regards and thanks for testing.

              1 Reply Last reply Reply Quote 0
              • O
                omascia
                last edited by

                @bmeeks:

                A patch was submitted to Github.  Unfortunately it was for the 2.1-BETA code base and not the 2.0.x production tree of Suricata we use in pfSense.  That will slow down my getting something ready for @gsiemon to test for me.  I will get it done, though.  I know a lot of folks want PPPoE support in Suricata.

                Bill

                Count me in!  I'm too so much interested in getting an updated 2.0.x Suricata pfSense package with that PPPoE fix, without waiting for Suricata 2.1 to get out of beta and later for pfSense to re-upgrade to that one.

                1 Reply Last reply Reply Quote 0
                • bmeeksB
                  bmeeks
                  last edited by

                  I have the patch back ported to the 2.0.x branch and tested.  I will post it soon for the pfSense Team to review and hopefully approve.  I have been waiting and waiting and waiting for the FreeBSD Port to update to version 2.0.7 of Suricata, but that has still not happened.

                  Bill

                  1 Reply Last reply Reply Quote 0
                  • O
                    omascia
                    last edited by

                    Thanks a lot Bill for your efforts.

                    Olivier

                    1 Reply Last reply Reply Quote 0
                    • bmeeksB
                      bmeeks
                      last edited by

                      The pfSense Team is helping push the PPPoE patch for Suricata into the FreeBSD ports tree.  I have been swapping a few e-mails with the required FreeBSD parties to see what we can shake loose.  So be patient a bit longer.  The ideal solution is for the patch to be in FreeBSD ports and then pfSense can just pull from there.  We all like to keep the binary packages on pfSense as close to "pure" with respect to the FreeBSD ports tree as possible.

                      Bill

                      1 Reply Last reply Reply Quote 0
                      • M
                        mauritsl
                        last edited by

                        Thanks! Excited to go live with suricata :D and PPPOE.

                        1 Reply Last reply Reply Quote 0
                        • M
                          mauritsl
                          last edited by

                          Hi All,

                          Pfsense is saying–> New version 2.1.4 but still loads 2.06.

                          When can we expect the fixed PPPOE?

                          Thx all!

                          1 Reply Last reply Reply Quote 0
                          • bmeeksB
                            bmeeks
                            last edited by

                            @mauritsl:

                            Hi All,

                            Pfsense is saying–> New version 2.1.4 but still loads 2.06.

                            When can we expect the fixed PPPOE?

                            Thx all!

                            We are waiting for the FreeBSD port maintainer to update the Suricata port.  That was supposed to happen last week, but obviously did not.  The pfSense Team is making some other housekeeping changes to packages getting ready to move from PBIs to pkg-ng.  Those changes are likely what is prompting the "new" versions showing up.  They are not really "new".

                            Bill

                            1 Reply Last reply Reply Quote 0
                            • M
                              mauritsl
                              last edited by

                              Thx Bill for the fast response and work.

                              1 Reply Last reply Reply Quote 0
                              • bmeeksB
                                bmeeks
                                last edited by

                                The Pull Request to post the updated Suricata code has been submitted.  Here is a link for those that want to track the progress:  https://github.com/pfsense/pfsense-packages/pull/875.  Once approved by the pfSense Team and merged, the update will appear as Suricata v2.1.5.  The underlying binary will be version 2.0.8, and it will support PPPoE connections on pfSense.

                                Bill

                                1 Reply Last reply Reply Quote 0
                                • M
                                  mauritsl
                                  last edited by

                                  For the PPPOE it looks OK now, so I' am/we are one step in the right direction :)

                                  14/5/2015 – 21:44:52 - <info>-- Running in 'auto' checksum mode. Detection of interface state will require 1000 packets.
                                  14/5/2015 -- 21:44:52 - <info>-- Found an MTU of 1492 for 'pppoe0'
                                  14/5/2015 -- 21:44:52 - <info>-- Set snaplen to 1508 for 'pppoe0'

                                  Now I get he following:

                                  14/5/2015 -- 21:44:52 - <error>-- [ERRCODE: SC_ERR_POOL_INIT(66)] - alloc error
                                  14/5/2015 – 21:44:52 - <error>-- [ERRCODE: SC_ERR_POOL_INIT(66)] - pool grow failed

                                  What can this mean?

                                  Thx for all your support</error></error></info></info></info>

                                  1 Reply Last reply Reply Quote 0
                                  • bmeeksB
                                    bmeeks
                                    last edited by

                                    @mauritsl:

                                    For the PPPOE it looks OK now, so I' am/we are one step in the right direction :)

                                    14/5/2015 – 21:44:52 - <info>-- Running in 'auto' checksum mode. Detection of interface state will require 1000 packets.
                                    14/5/2015 -- 21:44:52 - <info>-- Found an MTU of 1492 for 'pppoe0'
                                    14/5/2015 -- 21:44:52 - <info>-- Set snaplen to 1508 for 'pppoe0'

                                    Now I get he following:

                                    14/5/2015 -- 21:44:52 - <error>-- [ERRCODE: SC_ERR_POOL_INIT(66)] - alloc error
                                    14/5/2015 – 21:44:52 - <error>-- [ERRCODE: SC_ERR_POOL_INIT(66)] - pool grow failed

                                    What can this mean?

                                    Thx for all your support</error></error></info></info></info>

                                    Don't know for sure, but offhand, based on the error code text, I would say it's some kind of memory allocation error.

                                    Bill

                                    1 Reply Last reply Reply Quote 0
                                    • dotOneD
                                      dotOne
                                      last edited by

                                      See https://forum.pfsense.org/index.php?topic=93926.msg521328#msg521328

                                      Increasing the 'Stream Memory Cap' value or decreasing the number of Preallocated sessions will solve it.

                                      André

                                      1 Reply Last reply Reply Quote 0
                                      • T
                                        theopg
                                        last edited by

                                        I change the default 32mb stream memory cap to a little bit more and that’s resolved the problem.

                                        1 Reply Last reply Reply Quote 0
                                        • M
                                          mauritsl
                                          last edited by

                                          Works perfect now had to put little over 64mb to make it work
                                          Thx all for the fast responses. Have a nice weekend!

                                          1 Reply Last reply Reply Quote 0
                                          • N
                                            nikkon
                                            last edited by

                                            where do you change this value on version 3.0_7 available on pfsense 2.3_1?

                                            pfsense 2.3.4 on Supermicro A1SRi-2758F + 8GB ECC + SSD

                                            Happy PfSense user :)

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.