Snort problem



  • Hi!

    I have problem 1 with startup, in need this manual and later no alerts and no block form pf box.

    What is the problem?



  • Hi. 1st use 1.2.2
    2nd install latest snort
    3rd update the rules
    And you are ready to go.
    It works here.

    thanks,
    jigp
    Davao City



  • I have all of this.

    • new install 1.2.2, and it is not working.


  • Please post more info and setting of your snort.Thanks
    jigp
    Davao City



  • I've noticed that since I've reinstalled my two boxes neither one is blocking anything.  I don't know what has happened, but I noticed that before the memory usage was around 40-55 and now it's at 10-15.
    I have no blocks and everything is up to date- I even did an update to the latest firmware and then tried to reinstall the package.
    Weird.



  • I've got a stange issue with snort as well… after gracefully shutting down my network for a week later I brought PFS back up and updated Snort rules... I now have this message in my log:

    snort[3004]: FATAL ERROR: Warning: /usr/local/etc/snort/rules/netbios.rules(24) => Unknown keyword ' dce_iface' in rule!

    I can't locate that reference in any of the netbios.rules and the Snort Service does appear to be running (in services menu) and stays up but no alerts and nothing is being blocked… I would say it's not working correctly if at all.

    I've tried both reinstalling and uninstalling the package already and no help there… any ideas would be appreciated!



  • Try knocking off some of the rules; I was going through my rules and noticed that a lot of them have grown in size.  I unchecked a bunch of the larger rules and it seems to be running again.  I'm still playing with it, but wanted to mention it as a possibility.  I have 512mb in my 933mhz system and it was working fine up until about a month ago, but I never had time to reload and try testing things.

    ** Ok, here is what I've found with changing my rules - I have all except empty rule sets and web-misc, web-cgi, web-activex, netbios, deleted, and backdoor.  I'm close to 90% memory use.  Anyone else having the same problem?  **



  • I agree,… this is how to fix snort. Thanks

    How can we fiks snort to have more memory.

    I have P4 2.8GHz + 3GB Memory on 80GB hdd



  • I tried the other rulesets that I left out on my other snort machine and they all work fine except web-misc; for some reason it causes things to not load.  The service is still running, but nothing is blocked.  Since not many people are responding to this thread, does anyone else have this problem or are you guys not using snort, or not using the web-misc ruleset?  I'm going to go through the web-misc and see which one of the rules is causing problems.

    Thanks.



  • What is your Snort performance setting..I find that ac-bnfa works the best..loads faster and uses less Ram…. Ram runs between 17-40% with Snort,Squid,Havp,Squidguard, and nut running. I have 2 gigs ram. I don't have all the rules enabled though.



  • @ColdFusion:

    What is your Snort performance setting..I find that ac-bnfa works the best..loads faster and uses less Ram…. Ram runs between 17-40% with Snort,Squid,Havp,Squidguard, and nut running. I have 2 gigs ram. I don't have all the rules enabled though.

    I was using ac-banded, but I've used ac-sparsebands before and it seemed to work well.  I'll try ac-bnfa and see how it works.  I only have 512mb or ram right now, but I'm going to try and get more soon.

    Thanks.



  • Yea, 512 Ram is a bit low…ac-bnfa definitely works the best in my opinion..even with 2 gigs of ram..the performance seems better.



  • @ColdFusion:

    Yea, 512 Ram is a bit low…ac-bnfa definitely works the best in my opinion..even with 2 gigs of ram..the performance seems better.

    This is my new favorite setting in snort; awesome output and low memory usage.  I have every ruleset chosen except empty ones, netbios, and web-misc; wow - only 34% memory usage.  Better than all the other options.  I may have to add netbios and then figure out why web-misc causes things to stop being filtered.

    Thanks for your input ColdFusion.



  • hi i tryed to update to 1.2.3 to make it work and it seemed to help "a little"
    snort updated for me via the web
    and claims to be running…

    i checked out the services page says its running
    also did ps -aux still says its running

    i was trying to work out why i was getting no alerts from snort looking at snort.conf i added a line at the bottom for local.rules with the plan of adding a rule "alert tcp any any -> any any (msg:"im seeing stuff"; sid:1000111; rev:1)" for any traffic how ever when i tryed to do cd $RULE_PATH the variable is not defined.... that seems to be why snort is not working for me... can any one help me to make it work please...



  • note i am connected to the irc channel also



  • i found out snorts conf file configured that variable so after i went to the folder and made my rule
    now snort will not start…



  • i managed to get snort started and i think this will help a lot of people…

    go to the shell
    type snort
    read error message :)



  • have you tried what we've done so far or knocking down your rules to just icmp or something that you know you would get alerts if you had it enabled?  What is your system specs? (cpu/ram?)



  • @goulou:

    I've got a stange issue with snort as well… after gracefully shutting down my network for a week later I brought PFS back up and updated Snort rules... I now have this message in my log:

    snort[3004]: FATAL ERROR: Warning: /usr/local/etc/snort/rules/netbios.rules(24) => Unknown keyword ' dce_iface' in rule!

    I can't locate that reference in any of the netbios.rules and the Snort Service does appear to be running (in services menu) and stays up but no alerts and nothing is being blocked… I would say it's not working correctly if at all.

    I've tried both reinstalling and uninstalling the package already and no help there… any ideas would be appreciated!

    You know what's strange about this also is I get the same error on my other PF box with Snort version
    2.6.21_10, but I don't get it on my other PF box that has version 2.6.21_08. Both have latest rules from 5/11/09.



  • I think that the problems with the shoulder quantity reserved for snort



  • The issues with the netbios rules are most likely due to sourcefire revamping of the ruleset. They have added some extra preprocessors to handle the recent MS08-067 vulnerabilities.

    Check this out if you want more information:
    http://isc.sans.org/diary.html?storyid=6151



  • Seems about right. Just updated rules to 5/14 and get the error now on this pf box.



  • @ColdFusion:

    @goulou:

    I've got a stange issue with snort as well… after gracefully shutting down my network for a week later I brought PFS back up and updated Snort rules... I now have this message in my log:

    snort[3004]: FATAL ERROR: Warning: /usr/local/etc/snort/rules/netbios.rules(24) => Unknown keyword ' dce_iface' in rule!

    I can't locate that reference in any of the netbios.rules and the Snort Service does appear to be running (in services menu) and stays up but no alerts and nothing is being blocked… I would say it's not working correctly if at all.

    I've tried both reinstalling and uninstalling the package already and no help there… any ideas would be appreciated!

    You know what's strange about this also is I get the same error on my other PF box with Snort version
    2.6.21_10, but I don't get it on my other PF box that has version 2.6.21_08. Both have latest rules from 5/11/09.

    Thanks for the feedback on this… Wish I could say that I have another sugesstion but I don't.



  • Can anyone help me with this error that i got with snort.  I don't know what it means but i have 2GB or ram and only 12% is only beening used.

    May 22 01:15:15 snort[14339]: FATAL ERROR: Misconfigured dynamic preprocessor(s)
    May 22 01:15:15 snort[14339]: FATAL ERROR: Misconfigured dynamic preprocessor(s)
    May 22 01:15:32 SnortStartup[14422]: Ram free BEFORE starting Snort: 112M – Ram free AFTER starting Snort: 112M -- Mode ac-sparsebands -- Snort memory usage:

    May 22 01:23:22 snort[1843]: Alert on commands: None
    May 22 01:23:22 snort[1843]: /usr/local/etc/snort/snort.conf(276) unknown dynamic preprocessor "dcerpc2"
    May 22 01:23:22 snort[1843]: /usr/local/etc/snort/snort.conf(276) unknown dynamic preprocessor "dcerpc2"
    May 22 01:23:22 snort[1843]: /usr/local/etc/snort/snort.conf(277) unknown dynamic preprocessor "dcerpc2_server"
    May 22 01:23:22 snort[1843]: /usr/local/etc/snort/snort.conf(277) unknown dynamic preprocessor "dcerpc2_server"

    Thanks guys.



  • Do you have netbios rules enabled?? Seems to be an issue if you look at the previous posts…I found this that's why I asked??
    www.snort.org/vrt/tools/using-dcerpc2.html


  • Rebel Alliance Developer Netgate

    @1clicc:

    Can anyone help me with this error that i got with snort.  I don't know what it means but i have 2GB or ram and only 12% is only beening used.
    [snip]

    The snort package is being updated, but there is an issue with it that didn't get fixed last night. Hopefully it will get fixed at some point today.



  • @ColdFusion:

    Do you have netbios rules enabled?? Seems to be an issue if you look at the previous posts…I found this that's why I asked??
    www.snort.org/vrt/tools/using-dcerpc2.html

    Nope i don't have netbois rules enable.

    @ColdFusion:

    Do you have netbios rules enabled?? Seems to be an issue if you look at the previous posts…I found this that's why I asked??
    www.snort.org/vrt/tools/using-dcerpc2.html

    It couble be because i just install snort last night.  When do you think this will be fix?


  • Rebel Alliance Developer Netgate

    @1clicc:

    It couble be because i just install snort last night.  When do you think this will be fix?

    Last I heard they were waiting to hear back from the person who submitted the updated package. If it can't be made to work, I imagine it will get rolled back to the last working version. You can watch the package commit logs to see if anything has changed:

    https://rcs.pfsense.org/projects/pfsense-packages



  • Hope this can be resolve very soon.  Please do keep us updated when there's a fix.  Thanks you.



  • Hey guys, may i have the previous working version because i think this going to be awhile before it will be fix.  Anyone know where i can download the previous version? and how would i manually install it?  Thanks and much appreciation.



  • Hello Guys

    attached please find the snort.inc that now fix the problem, and snort is running again.
    the thing is I have disabled the new "dcerpc2" & "dcerpc2_server" and got back to the old "dcerpc" that does exist.

    go to Edit file under pfsense menu and load: /usr/local/pkg/snort.inc and replace the content of this file with the one that is attached.
    thats it, snort will be working perfectly now.

    good luck. :)

    Snort.inc.txt



  • @shaddow501:

    Hello Guys

    attached please find the snort.inc that now fix the problem, and snort is running again.
    the thing is I have disabled the new "dcerpc2" & "dcerpc2_server" and got back to the old "dcerpc" that does exist.

    go to Edit file under pfsense menu and load: /usr/local/pkg/snort.inc and replace the content of this file with the one that is attached.
    thats it, snort will be working perfectly now.

    good luck. :)

    Actually i got this error now:

    May 23 10:18:54 snort[2335]: FATAL ERROR: /usr/local/etc/snort/snort.conf(214) => FTP Commands are no longer than 4 characters: '#MACB'.
    May 23 10:18:54 snort[2335]: FATAL ERROR: /usr/local/etc/snort/snort.conf(214) => FTP Commands are no longer than 4 characters: '#MACB'.
    May 23 10:19:11 SnortStartup[2408]: Ram free BEFORE starting Snort: 88M – Ram free AFTER starting Snort: 88M -- Mode ac-sparsebands -- Snort memory usage:

    Any recommendation? because snort is not start also.



  • Its mean that you didn't save the file correctly cause the change wasn't implemented.
    after implementing the file you need to save. and then save again in the snort setting page.

    also I have checked and the netbios rules should not be checked till the dcerpc2 and dcerpc2_server, will be compiled correctly into the snort package



  • this is fixed in the package now



  • What is fixed?
    i do not see any package update?
    can you please be more specific what is fixed? and how? did you add the preprocessor "dcerpc2" and the preprocessor "dcerpc2_server" ?
    or just modify the snort.inc to disable the use of them?



  • @cmb:

    this is fixed in the package now

    OK, Confirm that it is now working after i uninstall and reinstall from the package.  Thanks guys you guys are highly appreciated.



  • Well it is not really fixed…. netbios rules still get snort to fail.



  • @shaddow501:

    Well it is not really fixed…. netbios rules still get snort to fail.

    Use the netbios.rules from the so_rules folder.



  • I've tried all of the suggestions contained within this thread and it's still not functioning properly. My PfSense box has been up and running for over 30 hours and not a single Snort alert in all that time. I just don't understand what the problem is. Can anyone advise?

    Thanks…



  • @Roodawakening:

    I've tried all of the suggestions contained within this thread and it's still not functioning properly. My PfSense box has been up and running for over 30 hours and not a single Snort alert in all that time. I just don't understand what the problem is. Can anyone advise?

    Thanks…

    Do you have any snort rules in the Categories section of snort?  If you are using pfsense 1.2.2 version i believe that it's haveing problem updating the rules so you might have to manually download the latest rules from snort.org and do a SSH and also manually install the rules.  If you have the latest rules already install than you might have to start the service.


Log in to reply