Snort LAN Alert

slim2016

Yes, that is correct. I've also removed snort and reinstalled but that made no difference. Once I receive another Snort LAN alert I will post a screenshot. The last alert I remember was my ip phone as the source and the destination was the sip server in the firewall logs. Obviously there is no alerts in the snort application because there is no LAN interface and nothing is getting blocked just alerts.

slim2016

I ran that command again in full screen and yes it is only showing em1, which is my WAN interface

36373  -  SNs      5:46.10 /usr/local/bin/snort -R 12902 -D -q --suppress-config-log -l /var/log/snort/snort_em112902 --pid-path /var/run --nolock-pidfile -G 12902 -c /usr/local/etc/snort/snort_12902_em1/snort.conf -i em1
14119  0  S+       0:00.00 grep snort

@bmeeks:

@slim2016:
The only response i'm getting from the command is
15824  -  S       0:00.00 sh -c ps -ax | grep snort 2>&1
16030  -  S       0:00.00 grep snort
60105  -  SNs   182:42.94 /usr/local/bin/snort -R 12902 -D -q --suppress-config
Yeah, the rest of the command is getting clipped by the 80-column display limit. The interface name is out on the end of the line. If you had Snort "stopped" in the GUI when you got this output, then the listed process (60105) is a zombie and you should kill it. However, if Snort was running in the GUI when you ran the command then things look OK.

Snort can't generate alerts when it is not running on an interface (as in the CLI shows no active Snort processes when the GUI shows Snort is "down").

So to review what you did – you first set up Snort on your WAN, and then you later added a LAN interface. After a day you decided to delete the LAN interface but kept the WAN interface. Is that correct?

Bill

slim2016

See the attached screen shot

![Screen Shot 2018-01-24 at 11.46.32.png](/public/imported_attachments/1/Screen Shot 2018-01-24 at 11.46.32.png)
![Screen Shot 2018-01-24 at 11.46.32.png_thumb](/public/imported_attachments/1/Screen Shot 2018-01-24 at 11.46.32.png_thumb)

bmeeks

Are you also getting alerts labelled WAN, or is everything showing up as LAN? If everything is LAN, one possibility is that during the LAN deletion the array indexes got messed up. The package stores information about all the configured interfaces in an array. The first interface you create is array index 0, the next is array index 1 and so on. Maybe that index got messed up with the interface deletion ???.

If you are getting both WAN and LAN alerts, then I am really baffled. If you are getting just alerts labelled LAN only, then it is likely the index problem I mentioned. If the latter case is true, then PM me and I can have you send me the pertinent section of your config.xml file via email and I can fix it up. Or, if it's not too much trouble, just remove the Snort package and reinstall. Before you do that, go to GLOBAL SETTTINGS and uncheck the "Save settings" checkbox near the bottom of the page so that Snort will remove all traces of itself including this current configuration. Install the package fresh and configure it again and you should be good to go.

Bill

slim2016

Yes i'm getting WAN and LAN alerts. I did remove the package then reinstalled it but that didn't make any difference. I'll do it again and make sure that I reboot after each operation.

bmeeks

@slim2016:

Yes i'm getting WAN and LAN alerts. I did remove the package then reinstalled it but that didn't make any difference. I'll do it again and make sure that I reboot after each operation.

In your case, just in the event your current Snort configuration is borked somehow, uncheck that "Save Settings" checkbox so Snort will remove the current configuration when the package uninstall routine runs. Then when you reinstall, it will be a virgin installation with no pre-existing confguration. As long as the "Save Settings" box is checked (and checked is the default), the configuration information will be saved and used again when the package is reinstalled. So any corruption, if present, will keep coming back.

Bill

slim2016

I did as you said and I just checked the logs, see the attached pic. Loads of snort LAN alerts.

![Screen Shot 2018-01-24 at 22.24.40.png](/public/imported_attachments/1/Screen Shot 2018-01-24 at 22.24.40.png)
![Screen Shot 2018-01-24 at 22.24.40.png_thumb](/public/imported_attachments/1/Screen Shot 2018-01-24 at 22.24.40.png_thumb)

slim2016

I would like to add that even though I unticked the box in GLOBAL SETTINGS "Keep Snort Settings After Deinstall" and after rebooting and reinstalling snort my configuration was still there. I didn't have to insert my snort code and I didn't have to add the WAN interface because it was already there. The only thing i had to do was to download the rule and start snort.

bmeeks

@slim2016:

I would like to add that even though I unticked the box in GLOBAL SETTINGS "Keep Snort Settings After Deinstall" and after rebooting and reinstalling snort my configuration was still there. I didn't have to insert my snort code and I didn't have to add the WAN interface because it was already there. The only thing i had to do was to download the rule and start snort.

You have a demon in that box! :D. That should never happen. With that box unchecked (and I assume you did a "Save" after unchecking it), Snort deletes the entire Snort configuration section of your config.xml file for the firewall. That removes everything for Snort including Oinkmaster code, rule selections, interfaces and everything; even including log files.

So if that did not happen, I am truly and fully perplexed. Are you sure you clicked SAVE at the bottom of the GLOBAL SETTINGS page when you unchecked that "save settings" checkbox before doing the uninstall?

Bill

slim2016

Yes 100%, i triple checked, because I remember the first time i removed the package it did the same.

I think the best thing to do is save the the config.xml and do a fresh install, i think it's easiest and quickest method the fix the problem.

bmeeks

@slim2016:

Yes 100%, i triple checked, because I remember the first time i removed the package it did the same.

I think the best thing to do is save the the config.xml and do a fresh install, i think it's easiest and quickest method the fix the problem.

Don't import that saved config or you will bring the problem right back. Everything for Snort is contained in that config file. So if it is corrupted in some fashion and you import the saved one into a fresh install, your fresh install is going to get corrupted again.

Bill

slim2016

I did a fresh install, I installed squid then squidguard and then snort and i'm still getting LAN alerts

![Screen Shot 2018-01-26 at 12.26.05.png](/public/imported_attachments/1/Screen Shot 2018-01-26 at 12.26.05.png)
![Screen Shot 2018-01-26 at 12.26.05.png_thumb](/public/imported_attachments/1/Screen Shot 2018-01-26 at 12.26.05.png_thumb)

bmeeks

@slim2016:

I did a fresh install, I installed squid then squidguard and then snort and i'm still getting LAN alerts

What is showing on your ALERTS tab in Snort for the LAN? Your screenshot is from the firewall system log.

Bill

slim2016

There are no LAN alerts in snort alert tab. I've just left it as it is, everything is working just fine.