Snort reload/restart

[dialsc]

Hi

I'm totally new to pfsense and snort but got it set up and running, so far so good. What I found is when ever I e.g. add a specific rule to the supress list from the snort alerts UI, the process is getting stopped and does not start by its own afterwards so I have to start it manually. Is this normal/by design or is there anything I'm missing?

[bmeeks]

@dialsc said in Snort reload/restart:

Hi

I'm totally new to pfsense and snort but got it set up and running, so far so good. What I found is when ever I e.g. add a specific rule to the supress list from the snort alerts UI, the process is getting stopped and does not start by its own afterwards so I have to start it manually. Is this normal/by design or is there anything I'm missing?

It should not stop. Have you looked in the system log to see what, if any, error messages might be showing up?

[dialsc]

Thank you very much for your answer.

I can see this kind of behaviour on two independend pfsense installations. As soon as I click the "add to suppress list" cross button the logs start showing:

Jul 18 13:05:41 pfSense check_reload_status: Syncing firewall
Jul 18 13:05:41 pfSense php-fpm[342]: /snort/snort_alerts.php: [Snort] Snort RELOAD CONFIG for WAN_LAN_BRIDGE(bridge0)...
Jul 18 13:05:41 pfSense php-fpm[342]: /snort/snort_alerts.php: [Snort] Snort RELOAD CONFIG for WAN_LAN_BRIDGE(bridge0)...
Jul 18 13:05:41 pfSense snort[40340]:
Jul 18 13:05:41 pfSense snort[40340]:         --== Reloading Snort ==--
Jul 18 13:05:41 pfSense snort[40340]:
Jul 18 13:05:41 pfSense snort[40340]: PortVar 'DNS_PORTS' defined :
Jul 18 13:05:41 pfSense snort[40340]:  [ 53 ]
.
.
.

Followed by this snipe after a lot of other log entries:

Jul 18 13:05:41 pfSense snort[40340]: PortVar 'GTP_PORTS' defined :
Jul 18 13:05:41 pfSense snort[40340]:  [ 2123 2152 3386 ]
Jul 18 13:05:41 pfSense snort[40340]:
Jul 18 13:05:41 pfSense snort[40340]: Detection:
Jul 18 13:05:41 pfSense snort[40340]:    Search-Method = AC-BNFA
Jul 18 13:05:41 pfSense snort[40340]:     Maximum pattern length = 20
Jul 18 13:05:41 pfSense snort[40340]:     Search-Method-Optimizations = enabled
Jul 18 13:05:42 pfSense snort[40340]: Found pid path directive (/var/run)
Jul 18 13:05:42 pfSense snort[40340]: Snort Reload: Any change to the dynamic preprocessor configuration requires a restart.
Jul 18 13:05:42 pfSense snort[40340]:
Jul 18 13:05:42 pfSense snort[40340]: ***** Restarting Snort *****
Jul 18 13:05:42 pfSense snort[40340]:
Jul 18 13:05:43 pfSense snort[40340]: ===============================================================================
Jul 18 13:05:43 pfSense snort[40340]: Run time for packet processing was 24959.737680 seconds
Jul 18 13:05:43 pfSense snort[40340]: Snort processed 3523987 packets.
Jul 18 13:05:43 pfSense snort[40340]: Snort ran for 0 days 6 hours 55 minutes 59 seconds
Jul 18 13:05:43 pfSense snort[40340]:     Pkts/hr:       587331
Jul 18 13:05:43 pfSense snort[40340]:    Pkts/min:         8491
Jul 18 13:05:43 pfSense snort[40340]:    Pkts/sec:          141
Jul 18 13:05:43 pfSense snort[40340]: ===============================================================================
.
.
.

Towards the end it reaches the following state:

Jul 18 13:05:43 pfSense snort[40340]: ===============================================================================
Jul 18 13:05:43 pfSense snort[40340]: Application Identification Preprocessor:
Jul 18 13:05:43 pfSense snort[40340]:    Total packets received : 2831032
Jul 18 13:05:43 pfSense snort[40340]:   Total packets processed : 2715732
Jul 18 13:05:43 pfSense snort[40340]:     Total packets ignored : 115300
Jul 18 13:05:43 pfSense snort[40340]: ===============================================================================
Jul 18 13:05:43 pfSense snort[40340]: +-----------------------[filtered events]--------------------------------------
Jul 18 13:05:43 pfSense snort[40340]: | gen-id=1      sig-id=2011716    type=Limit     tracking=src count=5   seconds=120 filtered=72
.
.
.
Jul 18 13:05:43 pfSense snort[40340]: | gen-id=122    sig-id=21         type=Suppress  tracking=src-ip=<list>           filtered=1

Then it just stops dumping information into the system.log log file and snort is stopped at the interface while Barnyard2 is still running.

As I mentioned above this is exactly the same behaviour as I see it on another box running snort on top of pfsense.

These are the details about the environment:

• pfsense version -> 2.4.4-RELEASE-p3
• snort version -> 3.2.9.8_6

[bmeeks]

Is the other box also configured with a bridge interface? That configuration is not something I have ever tested with the Snort package on pfSense.

[dialsc]

No, it is not. Just two "ordinary" interfaces -> WAN & LAN.