Snort Will Not Download

BryceTech

I installed Snoet and enabled OpenID then I went to update and everything went well exept it didnt download the Snort OpenAppID Detectors but it did download the Snort OpenAppID RULES Detectors please help

Thanks

LOG FILE:

Starting rules update… Time: 2018-05-01 23:33:45
Downloading Snort Subscriber rules md5 file snortrules-snapshot-29111.tar.gz.md5...
Checking Snort Subscriber rules md5 file...
There is a new set of Snort Subscriber rules posted.
Downloading file 'snortrules-snapshot-29111.tar.gz'...
Done downloading rules file.
Snort Subscriber rules file download failed. Bad MD5 checksum.
Done downloading rules file.
Downloaded Snort Subscriber rules file MD5: ecfd5697a21df7dd30e1f7b21a8b9775
Expected Snort Subscriber rules file MD5: ecfd5697a21df7dd30e1f7b21a8b9775
Snort Subscriber rules file download failed. Snort Subscriber rules will not be updated.
Downloading Snort OpenAppID detectors md5 file snort-openappid.tar.gz.md5...
Downloading Snort OpenAppID detectors md5 file snort-openappid.tar.gz.md5...
Snort OpenAppID detectors md5 download failed.
Server returned error code 404.
Server error message was: 404 Not Found
Snort OpenAppID detectors will not be updated.
Downloading Snort OpenAppID RULES detectors md5 file appid_rules.tar.gz.md5...
Snort OpenAppID detectors md5 download failed.
Server returned error code 404.
Server error message was: 404 Not Found
Snort OpenAppID detectors will not be updated.
Downloading Snort OpenAppID RULES detectors md5 file appid_rules.tar.gz.md5...
Checking Snort OpenAppID RULES detectors md5 file...
There is a new set of Snort OpenAppID RULES detectors posted.
Downloading file 'appid_rules.tar.gz'...
Checking Snort OpenAppID RULES detectors md5 file...
There is a new set of Snort OpenAppID RULES detectors posted.
Downloading file 'appid_rules.tar.gz'...
Done downloading rules file.
Downloading Snort GPLv2 Community Rules md5 file community-rules.tar.gz.md5...
Done downloading rules file.
Downloading Snort GPLv2 Community Rules md5 file community-rules.tar.gz.md5...
Checking Snort GPLv2 Community Rules md5 file...
There is a new set of Snort GPLv2 Community Rules posted.
Downloading file 'community-rules.tar.gz'...
Checking Snort GPLv2 Community Rules md5 file...
There is a new set of Snort GPLv2 Community Rules posted.
Downloading file 'community-rules.tar.gz'...
Done downloading rules file.
Downloading Emerging Threats Open rules md5 file emerging.rules.tar.gz.md5...
Checking Emerging Threats Open rules md5 file...
There is a new set of Emerging Threats Open rules posted.
Downloading file 'emerging.rules.tar.gz'...
Done downloading rules file.
Downloading Emerging Threats Open rules md5 file emerging.rules.tar.gz.md5...
Checking Emerging Threats Open rules md5 file...
There is a new set of Emerging Threats Open rules posted.
Downloading file 'emerging.rules.tar.gz'...
Done downloading rules file.
Emerging Threats Open rules file download failed. Bad MD5 checksum.
Downloaded Emerging Threats Open rules file MD5: 5b2d837274d8ad8fcb6bc38adc9dcd5e
Expected Emerging Threats Open rules file MD5: 47b3a39cc3af25d651ddddee594e8d51
Emerging Threats Open rules file download failed. Emerging Threats Open rules will not be updated.
Extracting and installing Snort OpenAppID detectors...
Installation of Snort OpenAppID detectors completed.
Extracting and installing Snort GPLv2 Community Rules...
Done downloading rules file.
Extracting and installing Snort Subscriber Ruleset...
Installation of Snort GPLv2 Community Rules completed.
Copying new config and map files...
Using Snort Subscriber precompiled SO rules for FreeBSD-10-0 ...
Installation of Snort Subscriber rules completed.
Extracting and installing Snort GPLv2 Community Rules...
Installation of Snort GPLv2 Community Rules completed.
Extracting and installing Emerging Threats Open rules...
Installation of Emerging Threats Open rules completed.
Copying new config and map files...
Updating rules configuration for: WAN ...
Updating rules configuration for: WAN ...
Updating rules configuration for: LAN ...
Restarting Snort to activate the new set of rules...
Snort has restarted with your new set of rules.
The Rules update has finished. Time: 2018-05-01 23:37:40

Updating rules configuration for: LAN ...
Restarting Snort to activate the new set of rules...

Gertjan

Hi,

This is not a General Question, but it concerns the package Snoet.
So, check out here pfSense Forum » pfSense English Support » Packages » IDS/IPS.

Btw :
This :```

Snort Subscriber rules file download failed. Snort Subscriber rules will not be updated.
Downloading Snort OpenAppID detectors md5 file snort-openappid.tar.gz.md5...
Downloading Snort OpenAppID detectors md5 file snort-openappid.tar.gz.md5...
Snort OpenAppID detectors md5 download failed.
Server returned error code 404.
Server error message was: 404 Not Found
Snort OpenAppID detectors will not be updated.
Downloading Snort OpenAppID RULES detectors md5 file appid_rules.tar.gz.md5...
Snort OpenAppID detectors md5 download failed.
Server returned error code 404.
Server error message was: 404 Not Found
Snort OpenAppID detectors will not be updated.

means that on the server side some problem happened and that files could not be send.
You have to see with the "Snort OpenAppID Detectors" guys what this means and why it happens.
I guess they have a support forum…

Even better : [ask the guy that has the answer already : **can not download Snort OpenAppID Detectors**](https://www.google.com/search?q=can+not+download+Snort+OpenAppID+Detectors&ie=utf-8&oe=utf-8&client=firefox-b) - because that's a more descriptive situation. Your Snort can download just fine, except for **one** source of rules.
[You have something useful on the very first proposed link](https://forum.pfsense.org/index.php?topic=141204.0).

r4kieta

Same issue here.
Downloading Snort OpenAppID detectors md5 file snort-openappid.tar.gz.md5…
Snort OpenAppID detectors md5 download failed.
Server returned error code 404.
Server error message was: 404 Not Found
Snort OpenAppID detectors will not be updated.

Else downloads fine.

trip5ter

Same error for me too :( any ideas on howto fix this?

Starting rules update… Time: 2018-05-03 20:19:37
Downloading Snort Subscriber rules md5 file snortrules-snapshot-29111.tar.gz.md5...
Checking Snort Subscriber rules md5 file...
There is a new set of Snort Subscriber rules posted.
Downloading file 'snortrules-snapshot-29111.tar.gz'...
Done downloading rules file.
Downloading Snort OpenAppID detectors md5 file snort-openappid.tar.gz.md5...
Snort OpenAppID detectors md5 download failed.
Server returned error code 404.
Server error message was: 404 Not Found

bmeeks

This is caused by a filename typo on the Snort.org download site. There is an extra "p" in the filename as shown below:

https://www.snort.org/downloads/openappid/snort-oppenappid.tar.gz.md5

Notice the extra "p" in "open" in the name above. That is causing the 404 - NOT FOUND error for the Snort OpenAppID rule updates. I've sent an email to my Snort contacts to see if they can fix the filename typo.

Bill

bmeeks

UPDATE

This problem should be fixed now. I heard back from the Snort.org team and they corrected the typo in the MD5 filename.

Bill

trip5ter

Thanks Bills - working great for me now.

Cheers