Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort Will Not Download

    General pfSense Questions
    5
    7
    2.0k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      BryceTech
      last edited by

      I installed Snoet and enabled OpenID then I went to update and everything went well exept it didnt download the Snort OpenAppID Detectors but it did download the Snort OpenAppID RULES Detectors please help

      Thanks

      LOG FILE:

      Starting rules update…  Time: 2018-05-01 23:33:45
      Downloading Snort Subscriber rules md5 file snortrules-snapshot-29111.tar.gz.md5...
      Checking Snort Subscriber rules md5 file...
      There is a new set of Snort Subscriber rules posted.
      Downloading file 'snortrules-snapshot-29111.tar.gz'...
      Done downloading rules file.
      Snort Subscriber rules file download failed.  Bad MD5 checksum.
      Done downloading rules file.
      Downloaded Snort Subscriber rules file MD5: ecfd5697a21df7dd30e1f7b21a8b9775
      Expected Snort Subscriber rules file MD5: ecfd5697a21df7dd30e1f7b21a8b9775
      Snort Subscriber rules file download failed.  Snort Subscriber rules will not be updated.
      Downloading Snort OpenAppID detectors md5 file snort-openappid.tar.gz.md5...
      Downloading Snort OpenAppID detectors md5 file snort-openappid.tar.gz.md5...
      Snort OpenAppID detectors md5 download failed.
      Server returned error code 404.
      Server error message was: 404 Not Found
      Snort OpenAppID detectors will not be updated.
      Downloading Snort OpenAppID RULES detectors md5 file appid_rules.tar.gz.md5...
      Snort OpenAppID detectors md5 download failed.
      Server returned error code 404.
      Server error message was: 404 Not Found
      Snort OpenAppID detectors will not be updated.
      Downloading Snort OpenAppID RULES detectors md5 file appid_rules.tar.gz.md5...
      Checking Snort OpenAppID RULES detectors md5 file...
      There is a new set of Snort OpenAppID RULES detectors posted.
      Downloading file 'appid_rules.tar.gz'...
      Checking Snort OpenAppID RULES detectors md5 file...
      There is a new set of Snort OpenAppID RULES detectors posted.
      Downloading file 'appid_rules.tar.gz'...
      Done downloading rules file.
      Downloading Snort GPLv2 Community Rules md5 file community-rules.tar.gz.md5...
      Done downloading rules file.
      Downloading Snort GPLv2 Community Rules md5 file community-rules.tar.gz.md5...
      Checking Snort GPLv2 Community Rules md5 file...
      There is a new set of Snort GPLv2 Community Rules posted.
      Downloading file 'community-rules.tar.gz'...
      Checking Snort GPLv2 Community Rules md5 file...
      There is a new set of Snort GPLv2 Community Rules posted.
      Downloading file 'community-rules.tar.gz'...
      Done downloading rules file.
      Downloading Emerging Threats Open rules md5 file emerging.rules.tar.gz.md5...
      Checking Emerging Threats Open rules md5 file...
      There is a new set of Emerging Threats Open rules posted.
      Downloading file 'emerging.rules.tar.gz'...
      Done downloading rules file.
      Downloading Emerging Threats Open rules md5 file emerging.rules.tar.gz.md5...
      Checking Emerging Threats Open rules md5 file...
      There is a new set of Emerging Threats Open rules posted.
      Downloading file 'emerging.rules.tar.gz'...
      Done downloading rules file.
      Emerging Threats Open rules file download failed.  Bad MD5 checksum.
      Downloaded Emerging Threats Open rules file MD5: 5b2d837274d8ad8fcb6bc38adc9dcd5e
      Expected Emerging Threats Open rules file MD5: 47b3a39cc3af25d651ddddee594e8d51
      Emerging Threats Open rules file download failed.  Emerging Threats Open rules will not be updated.
      Extracting and installing Snort OpenAppID detectors...
      Installation of Snort OpenAppID detectors completed.
      Extracting and installing Snort GPLv2 Community Rules...
      Done downloading rules file.
      Extracting and installing Snort Subscriber Ruleset...
      Installation of Snort GPLv2 Community Rules completed.
      Copying new config and map files...
      Using Snort Subscriber precompiled SO rules for FreeBSD-10-0 ...
      Installation of Snort Subscriber rules completed.
      Extracting and installing Snort GPLv2 Community Rules...
      Installation of Snort GPLv2 Community Rules completed.
      Extracting and installing Emerging Threats Open rules...
      Installation of Emerging Threats Open rules completed.
      Copying new config and map files...
      Updating rules configuration for: WAN ...
      Updating rules configuration for: WAN ...
      Updating rules configuration for: LAN ...
      Restarting Snort to activate the new set of rules...
      Snort has restarted with your new set of rules.
      The Rules update has finished.  Time: 2018-05-01 23:37:40

      Updating rules configuration for: LAN ...
      Restarting Snort to activate the new set of rules...

      1 Reply Last reply Reply Quote 0
      • GertjanG
        Gertjan
        last edited by

        Hi,

        This is not a General Question, but it concerns the package Snoet.
        So, check out here pfSense Forum » pfSense English Support » Packages » IDS/IPS.

        Btw :
        This :```

        Snort Subscriber rules file download failed.  Snort Subscriber rules will not be updated.
          Downloading Snort OpenAppID detectors md5 file snort-openappid.tar.gz.md5...
          Downloading Snort OpenAppID detectors md5 file snort-openappid.tar.gz.md5...
          Snort OpenAppID detectors md5 download failed.
          Server returned error code 404.
          Server error message was: 404 Not Found
          Snort OpenAppID detectors will not be updated.
          Downloading Snort OpenAppID RULES detectors md5 file appid_rules.tar.gz.md5...
          Snort OpenAppID detectors md5 download failed.
          Server returned error code 404.
          Server error message was: 404 Not Found
          Snort OpenAppID detectors will not be updated.

        means that on the server side some problem happened and that files could not be send.
You have to see with the "Snort OpenAppID Detectors" guys what this means and why it happens.
I guess they have a support forum…

Even better : [ask the guy that has the answer already : **can not download Snort OpenAppID Detectors**](https://www.google.com/search?q=can+not+download+Snort+OpenAppID+Detectors&ie=utf-8&oe=utf-8&client=firefox-b) - because that's a more descriptive situation. Your Snort can download just fine, except for **one** source of rules.
[You have something useful on the very first proposed link](https://forum.pfsense.org/index.php?topic=141204.0).

        No "help me" PM's please. Use the forum, the community will thank you.
        Edit : and where are the logs ??

        1 Reply Last reply Reply Quote 0
        • R
          r4kieta
          last edited by

          Same issue here.
          Downloading Snort OpenAppID detectors md5 file snort-openappid.tar.gz.md5…
          Snort OpenAppID detectors md5 download failed.
          Server returned error code 404.
          Server error message was: 404 Not Found
          Snort OpenAppID detectors will not be updated.

          Else downloads fine.

          1 Reply Last reply Reply Quote 0
          • T
            trip5ter
            last edited by

            Same error for me too :( any ideas on howto fix this?

            Starting rules update…  Time: 2018-05-03 20:19:37
            Downloading Snort Subscriber rules md5 file snortrules-snapshot-29111.tar.gz.md5...
            Checking Snort Subscriber rules md5 file...
            There is a new set of Snort Subscriber rules posted.
            Downloading file 'snortrules-snapshot-29111.tar.gz'...
            Done downloading rules file.
            Downloading Snort OpenAppID detectors md5 file snort-openappid.tar.gz.md5...
            Snort OpenAppID detectors md5 download failed.
            Server returned error code 404.
            Server error message was: 404 Not Found

            1 Reply Last reply Reply Quote 0
            • bmeeksB
              bmeeks
              last edited by

              This is caused by a filename typo on the Snort.org download site.  There is an extra "p" in the filename as shown below:

              https://www.snort.org/downloads/openappid/snort-oppenappid.tar.gz.md5

              Notice the extra "p" in "open" in the name above.  That is causing the 404 - NOT FOUND error for the Snort OpenAppID rule updates.  I've sent an email to my Snort contacts to see if they can fix the filename typo.

              Bill

              1 Reply Last reply Reply Quote 0
              • bmeeksB
                bmeeks
                last edited by

                UPDATE

                This problem should be fixed now.  I heard back from the Snort.org team and they corrected the typo in the MD5 filename.

                Bill

                1 Reply Last reply Reply Quote 0
                • T
                  trip5ter
                  last edited by

                  Thanks Bills - working great for me now.

                  Cheers

                  1 Reply Last reply Reply Quote 0
                  • First post
                    Last post
                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.