Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort problem

    pfSense Packages
    21
    104
    44.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      simonchs
      last edited by

      i'm running pfsense version 1.2.2

      thanks James

      1 Reply Last reply Reply Quote 0
      • J
        jamesdean
        last edited by

        @simonchs:

        i'm running pfsense version 1.2.2

        thanks James

        Theres usually a date like mine says

        1.2.3-RC1
        built on Wed Apr 22 15:36:34 EDT 2009

        1 Reply Last reply Reply Quote 0
        • F
          firbc
          last edited by

          @jamesdean:

          Hey firbc, simonchs..

          Can you guys tell me what version of pfsense your running. I have a feeling its 1.2 and not 1.2.3.

          Also, please tell me whats the output of "pkg_info".

          Help me help you.
          james

          I am running version 1.2.3-RC1, built on Fri May 22 16:32:57 EDT 2009 of pfSense.

          bandwidthd-2.0.1_1  Tracks bandwidth usage by IP address
          gd-2.0.35,1        A graphics library for fast creation of images
          grub-0.97_1        GRand Unified Bootloader
          jpeg-6b_4          IJG's jpeg compression utilities
          libdnet-1.11_3      A simple interface to low level networking routines
          libiconv-1.11_1    A character set conversion library
          libosip-3.1.0      A low layer of SIP implementation
          mysql-client-5.0.77_1 Multithreaded SQL database (client)
          mysql-client-5.1.34 Multithreaded SQL database (client)
          packages            BSD Installer mega-package
          pcre-7.8            Perl Compatible Regular Expressions library
          pcre-7.9            Perl Compatible Regular Expressions library
          siproxd-0.7.0_1    A proxy/masquerading daemon for the SIP protocol
          snort-2.8.4.1      Lightweight network intrusion detection system

          Any idea? Thx

          1 Reply Last reply Reply Quote 0
          • J
            jamesdean
            last edited by

            Fixed the problem waiting for new snort packages to be built.

            Please be pationant.

            Snort will be working on pfsense 1.2.2 soon.

            james

            1 Reply Last reply Reply Quote 0
            • ?
              Guest
              last edited by

              Welp i'm having similar problem with snort too.  I reinstalled a fresh copy of pfsense 1.2.2 because i mess it up and when it was running i had snort running beautifully until i reinstall snort after i did a fresh install of pfsense.  Before i install Snort i looked at the platform and it was for 1.2.3 but i was hoping it would work for 1.2.2 but i guess not.  Will the fix be up soon?  I would also like to suggest or request something from the pfsense team to put up multiple applicatoin for different platform so we won't get confuse.
              For example:  Snort 1.2.2
                                Snort 1.2.3
              Instead of a just single update.  Anyhow, you guys are doing a great job and we all appreciated.  Please let us know when the fix is up.  Thanks for everything.  Look foward to the fix.

              1 Reply Last reply Reply Quote 0
              • L
                lordarcane
                last edited by

                I´ll guess that my problem is related to the fact that I updated snort and now i´m unable to update the rules. Getting md5 signature mismatch and snort refuses to start.

                1 Reply Last reply Reply Quote 0
                • J
                  jamesdean
                  last edited by

                  @lordarcane:

                  I´ll guess that my problem is related to the fact that I updated snort and now i´m unable to update the rules. Getting md5 signature mismatch and snort refuses to start.

                  Thanx for the heads up. Snort.org changed there md5 format to day to go along with there nice new website.

                  From this > c2844479ed68cc0f13ab61f69e35bc7a

                  To this >MD5 (snortrules-snapshot-2.8.tar.gz) = c2844479ed68cc0f13ab61f69e35bc7a

                  Going have to code a fix.
                  Man Snort Package is killing me this week.
                  If they change it back after I code a fix, Im going on a vacation ASAP.

                  james

                  1 Reply Last reply Reply Quote 0
                  • M
                    mentalhemroids
                    last edited by

                    My thanks to JamesDean and anyone else working on this problem.  I know others appreciate the hard work done with this and all other packages.  It's not a easy task keeping up with technology, or life for that matter.

                    Thanks!

                    1 Reply Last reply Reply Quote 0
                    • ?
                      Guest
                      last edited by

                      So has there been a fix?

                      1 Reply Last reply Reply Quote 0
                      • S
                        serialdie
                        last edited by

                        Waiting for the MD5 fix as well :)

                        TIA!

                        1 Reply Last reply Reply Quote 0
                        • ?
                          Guest
                          last edited by

                          Can anyone tell me if this is normal?

                          May 31 12:56:05 snort[12638]: Warning: flowbits key 'PtakkS_Keepalive' is set but not ever checked. 
May 31 12:56:05 snort[12638]: Warning: flowbits key 'dce.bind.wkssvc' is set but not ever checked. 
May 31 12:56:05 snort[12638]: Warning: flowbits key 'dce.bind.wkssvc' is set but not ever checked. 
May 31 12:56:05 snort[12638]: Warning: flowbits key 'snipernet' is set but not ever checked. 
May 31 12:56:05 snort[12638]: Warning: flowbits key 'snipernet' is set but not ever checked. 
May 31 12:56:05 snort[12638]: 316 out of 512 flowbits in use. 
May 31 12:56:05 snort[12638]: 316 out of 512 flowbits in use.

                          Thank you.

                          1 Reply Last reply Reply Quote 0
                          • J
                            jamesdean
                            last edited by

                            I updated the the snort package today to fix the md5 error and snort.org's new oink code verification urls for rule updates.

                            Snort should work but there might be errors when snort.org goes down.
                            I still need to add code for primium snort.org oink users and clean up the code.
                            Have patience.

                            I need people to install the snort package post here. Post failers and success here. Please post your pfsense version and system specs.
                            Remember to update the rules befor starting snort after reinstall.

                            If anyone cares this is what happened this month with the snort package.

                            1. Snort.org changed there code codebase for rpc, result broke the pfsense snort packge.

                            2. I fixed the snort package.

                            3. Snort.org changed there md5 checksum format, result broke the pfsense snort packge.

                            4. I fixed the snort package.

                            5. Snort.org changed there urls, result broke the pfsense snort packge.

                            6. I fixed the snort package.

                            7. Snort.org changed there new oink code verification system , result broke the pfsense snort packge.

                            8. I fixed the snort package. All is good so far.

                            Thanx
                            James

                            P.S. 1clicc

                            Its normal.
                            Snort is just telling you you need to adjust your rules for your system. Read the snort manual for more help.

                            1 Reply Last reply Reply Quote 0
                            • AhnHELA
                              AhnHEL
                              last edited by

                              So far so good on my custom micro-atx box.  Startup completed with:

                              May 31 18:50:37 SnortStartup[59091]: Ram free BEFORE starting Snort: 112M – Ram free AFTER starting Snort: 112M -- Mode ac-bnfa -- Snort memory usage:
                              May 31 18:50:30 snort[58996]: Not Using PCAP_FRAMES
                              May 31 18:50:30 snort[58996]: Not Using PCAP_FRAMES
                              May 31 18:50:30 snort[58996]: Snort initialization completed successfully (pid=58996)
                              May 31 18:50:30 snort[58996]: Snort initialization completed successfully (pid=58996)

                              Much appreciated James, thank you for your work and service to the community.

                              1.2.3-RC1
                              built on Tue May 26 15:14:15 EDT 2009
                              FreeBSD 7.2-RELEASE i386

                              2 Gigs RAM
                              Processors  2
                              Model Genuine Intel(R) CPU 2160 @ 1.80GHz
                              CPU Speed 1.8 GHz
                              PCI Devices

                              • atapci0: Intel ICH5 SATA150 controller
                              • ehci0: Intel 82801EB/R (ICH5) USB 2.0 controller
                              • fxp0: Intel 82559ER Pro/100 Ethernet
                              • fxp1: Intel 82559ER Pro/100 Ethernet
                              • fxp2: Intel 82559ER Pro/100 Ethernet
                              • isab0: PCI-ISA bridge
                              • pcib1: ACPI PCI-PCI bridge
                              • uhci0: Intel 82801EB (ICH5) USB controller USB-A
                              • uhci1: Intel 82801EB (ICH5) USB controller USB-B
                              • uhci2: Intel 82801EB (ICH5) USB controller USB-C
                              • uhci3: Intel 82801EB (ICH5) USB controller USB-D
                              • vgapci0: VGA-compatible display
                                IDE Devices
                              • acd0: ASUS DVD-E616A3T/1.01
                              • ad0: WDC WD400JD-22MSA1 10.01E01 (Capacity: 39.10 GB)
                                SCSI Devices none
                                USB Devices none

                              AhnHEL (Angel)

                              1 Reply Last reply Reply Quote 0
                              • J
                                jamesdean
                                last edited by

                                Thanx onhel.

                                I need more user sytem info. Hope the community helps out.

                                Please post pfsense version and system specs.

                                1 Reply Last reply Reply Quote 0
                                • ?
                                  Guest
                                  last edited by

                                  First of all I would like to say Thank you and an excellent job well done.  As of right now i think snort is down so i couldn't get my oink code so i can't test the update.  But snort working great.

                                  May 31 18:16:21 shinigami snort[14439]: [ Port Based Pattern Matching Memory ]
May 31 18:16:21 shinigami snort[14439]: [ Port Based Pattern Matching Memory ]
May 31 18:16:21 shinigami snort[14439]: +-[AC-BNFA Search Info Summary]------------------------------
May 31 18:16:21 shinigami snort[14439]: +-[AC-BNFA Search Info Summary]------------------------------
May 31 18:16:21 shinigami snort[14439]: | Instances        : 655
May 31 18:16:21 shinigami snort[14439]: | Instances        : 655
May 31 18:16:21 shinigami snort[14439]: | Patterns         : 111013
May 31 18:16:21 shinigami snort[14439]: | Patterns         : 111013
May 31 18:16:21 shinigami snort[14439]: | Pattern Chars    : 1088067
May 31 18:16:21 shinigami snort[14439]: | Pattern Chars    : 1088067
May 31 18:16:21 shinigami snort[14439]: | Num States       : 801960
May 31 18:16:21 shinigami snort[14439]: | Num States       : 801960
May 31 18:16:21 shinigami snort[14439]: | Num Match States : 148254
May 31 18:16:21 shinigami snort[14439]: | Num Match States : 148254
May 31 18:16:21 shinigami snort[14439]: | Memory           :   20.44Mbytes
May 31 18:16:21 shinigami snort[14439]: | Memory           :   20.44Mbytes
May 31 18:16:21 shinigami snort[14439]: |   Patterns       :   3.58M
May 31 18:16:21 shinigami snort[14439]: |   Patterns       :   3.58M
May 31 18:16:21 shinigami snort[14439]: |   Match Lists    :   6.99M
May 31 18:16:21 shinigami snort[14439]: |   Match Lists    :   6.99M
May 31 18:16:21 shinigami snort[14439]: |   Transitions    :   9.71M
May 31 18:16:21 shinigami snort[14439]: |   Transitions    :   9.71M
May 31 18:16:21 shinigami snort[14439]: +-------------------------------------------------
May 31 18:16:21 shinigami snort[14439]: +-------------------------------------------------
May 31 18:16:21 shinigami snort[14439]: Snort initialization completed successfully (pid=14439)
May 31 18:16:21 shinigami snort[14439]: Snort initialization completed successfully (pid=14439)
May 31 18:16:21 shinigami snort[14439]: Not Using PCAP_FRAMES
May 31 18:16:21 shinigami snort[14439]: Not Using PCAP_FRAMES

                                  I will ilet you know once i get my oink code.  Thanks again for your hard work and you are certainly highly appreciated.

                                  1 Reply Last reply Reply Quote 0
                                  • T
                                    try
                                    last edited by

                                    THanks to Jamesdean snort working again in my pfSense running

                                    pfSense 1.2.2
                                    built on Thu Jan 8 22:39:31 EST 2009
                                    FreeBSD 7.0-RELEASE-p8 i386

                                    rules update in progress..

                                    I'll let you know when the update finished.

                                    edit:
                                    yes, the rules update also work, Snort says:
                                    Your rules are up to date…

                                    Cheers,

                                    1 Reply Last reply Reply Quote 0
                                    • J
                                      jamesdean
                                      last edited by

                                      Man oh man.

                                      Snort.org changed the way there files are downloaded. Third night in a row….
                                      The md5 file downloads but is emty. This is there way to enforce the 15 min wait for updates.

                                      thanx
                                      james

                                      1 Reply Last reply Reply Quote 0
                                      • H
                                        Hugovsky
                                        last edited by

                                        2 boxes:

                                        1-1.2.3-RC1
                                        built on Sat May 30 22:26:25 EDT 2009.
                                        snort package v.2.8.4
                                        Doing ppoe with bridged router. Can't update rules and everytime ip changes, snort won't restart. Restart snort mannualy to work.

                                        2-1.2.3-RC1
                                        built on Tue May 12 00:32:03 EDT 2009
                                        snort package v.2.8.4
                                        behind router. working like a charm.
                                        Can't update rules.

                                        Your work IS GREATLY apreciatted by me. It's because of people like you that I learn something every day. I just hope some day I could do something to help the community, just like you.

                                        BIG thanks for your work.

                                        1 Reply Last reply Reply Quote 0
                                        • S
                                          serialdie
                                          last edited by

                                          James,

                                          Do you have a pay pal link?
                                          I wont mind sending you a donation for all your work!!!

                                          Thanks!

                                          1 Reply Last reply Reply Quote 0
                                          • J
                                            jamesdean
                                            last edited by

                                            Thanx serialdie, Hugovsky. Your type of peple I'm doing this for. Send mony to the pfsense core developers so they can buy me a mini-itx.

                                            –------------------------------
                                            Added today

                                            Updates work again.
                                            "when did I last download, time stamps info" (just started)

                                            Adding latter today. If I have time.

                                            Rules backup option. you will need 180 megs for this.
                                            Alerts to system log. (Requested don't know why.)
                                            Identify snort package version.
                                            redo Update rules automatically option.
                                            RSS feeds.

                                            If there is any one here in the forums that is a Premium snort rules user, Please email me.

                                            james

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post