Snort problem

r3dn3ck

The issues with the netbios rules are most likely due to sourcefire revamping of the ruleset. They have added some extra preprocessors to handle the recent MS08-067 vulnerabilities.

Check this out if you want more information:
http://isc.sans.org/diary.html?storyid=6151

ColdFusion

Seems about right. Just updated rules to 5/14 and get the error now on this pf box.

goulou

@ColdFusion:

@goulou:

I've got a stange issue with snort as well… after gracefully shutting down my network for a week later I brought PFS back up and updated Snort rules... I now have this message in my log:

snort[3004]: FATAL ERROR: Warning: /usr/local/etc/snort/rules/netbios.rules(24) => Unknown keyword ' dce_iface' in rule!

I can't locate that reference in any of the netbios.rules and the Snort Service does appear to be running (in services menu) and stays up but no alerts and nothing is being blocked… I would say it's not working correctly if at all.

I've tried both reinstalling and uninstalling the package already and no help there… any ideas would be appreciated!

You know what's strange about this also is I get the same error on my other PF box with Snort version
2.6.21_10, but I don't get it on my other PF box that has version 2.6.21_08. Both have latest rules from 5/11/09.

Thanks for the feedback on this… Wish I could say that I have another sugesstion but I don't.

Guest

Can anyone help me with this error that i got with snort. I don't know what it means but i have 2GB or ram and only 12% is only beening used.

May 22 01:15:15 snort[14339]: FATAL ERROR: Misconfigured dynamic preprocessor(s)
May 22 01:15:15 snort[14339]: FATAL ERROR: Misconfigured dynamic preprocessor(s)
May 22 01:15:32 SnortStartup[14422]: Ram free BEFORE starting Snort: 112M – Ram free AFTER starting Snort: 112M -- Mode ac-sparsebands -- Snort memory usage:

May 22 01:23:22 snort[1843]: Alert on commands: None
May 22 01:23:22 snort[1843]: /usr/local/etc/snort/snort.conf(276) unknown dynamic preprocessor "dcerpc2"
May 22 01:23:22 snort[1843]: /usr/local/etc/snort/snort.conf(276) unknown dynamic preprocessor "dcerpc2"
May 22 01:23:22 snort[1843]: /usr/local/etc/snort/snort.conf(277) unknown dynamic preprocessor "dcerpc2_server"
May 22 01:23:22 snort[1843]: /usr/local/etc/snort/snort.conf(277) unknown dynamic preprocessor "dcerpc2_server"

Thanks guys.

ColdFusion

Do you have netbios rules enabled?? Seems to be an issue if you look at the previous posts…I found this that's why I asked??
www.snort.org/vrt/tools/using-dcerpc2.html

jimp

@1clicc:

Can anyone help me with this error that i got with snort. I don't know what it means but i have 2GB or ram and only 12% is only beening used.
[snip]

The snort package is being updated, but there is an issue with it that didn't get fixed last night. Hopefully it will get fixed at some point today.

Guest

@ColdFusion:

Do you have netbios rules enabled?? Seems to be an issue if you look at the previous posts…I found this that's why I asked??
www.snort.org/vrt/tools/using-dcerpc2.html

Nope i don't have netbois rules enable.

@ColdFusion:

Do you have netbios rules enabled?? Seems to be an issue if you look at the previous posts…I found this that's why I asked??
www.snort.org/vrt/tools/using-dcerpc2.html

It couble be because i just install snort last night. When do you think this will be fix?

jimp

@1clicc:

It couble be because i just install snort last night. When do you think this will be fix?

Last I heard they were waiting to hear back from the person who submitted the updated package. If it can't be made to work, I imagine it will get rolled back to the last working version. You can watch the package commit logs to see if anything has changed:

https://rcs.pfsense.org/projects/pfsense-packages

Guest

Hope this can be resolve very soon. Please do keep us updated when there's a fix. Thanks you.

Guest

Hey guys, may i have the previous working version because i think this going to be awhile before it will be fix. Anyone know where i can download the previous version? and how would i manually install it? Thanks and much appreciation.

shaddow501

Hello Guys

attached please find the snort.inc that now fix the problem, and snort is running again.
the thing is I have disabled the new "dcerpc2" & "dcerpc2_server" and got back to the old "dcerpc" that does exist.

go to Edit file under pfsense menu and load: /usr/local/pkg/snort.inc and replace the content of this file with the one that is attached.
thats it, snort will be working perfectly now.

good luck. :)

Snort.inc.txt

Guest

@shaddow501:

Hello Guys

attached please find the snort.inc that now fix the problem, and snort is running again.
the thing is I have disabled the new "dcerpc2" & "dcerpc2_server" and got back to the old "dcerpc" that does exist.

go to Edit file under pfsense menu and load: /usr/local/pkg/snort.inc and replace the content of this file with the one that is attached.
thats it, snort will be working perfectly now.

good luck. :)

Actually i got this error now:

May 23 10:18:54 snort[2335]: FATAL ERROR: /usr/local/etc/snort/snort.conf(214) => FTP Commands are no longer than 4 characters: '#MACB'.
May 23 10:18:54 snort[2335]: FATAL ERROR: /usr/local/etc/snort/snort.conf(214) => FTP Commands are no longer than 4 characters: '#MACB'.
May 23 10:19:11 SnortStartup[2408]: Ram free BEFORE starting Snort: 88M – Ram free AFTER starting Snort: 88M -- Mode ac-sparsebands -- Snort memory usage:

Any recommendation? because snort is not start also.

shaddow501

Its mean that you didn't save the file correctly cause the change wasn't implemented.
after implementing the file you need to save. and then save again in the snort setting page.

also I have checked and the netbios rules should not be checked till the dcerpc2 and dcerpc2_server, will be compiled correctly into the snort package

cmb

this is fixed in the package now

shaddow501

What is fixed?
i do not see any package update?
can you please be more specific what is fixed? and how? did you add the preprocessor "dcerpc2" and the preprocessor "dcerpc2_server" ?
or just modify the snort.inc to disable the use of them?

Guest

@cmb:

this is fixed in the package now

OK, Confirm that it is now working after i uninstall and reinstall from the package. Thanks guys you guys are highly appreciated.

shaddow501

Well it is not really fixed…. netbios rules still get snort to fail.

Guest

@shaddow501:

Well it is not really fixed…. netbios rules still get snort to fail.

Use the netbios.rules from the so_rules folder.

Roodawakening

I've tried all of the suggestions contained within this thread and it's still not functioning properly. My PfSense box has been up and running for over 30 hours and not a single Snort alert in all that time. I just don't understand what the problem is. Can anyone advise?

Thanks…

Guest

@Roodawakening:

I've tried all of the suggestions contained within this thread and it's still not functioning properly. My PfSense box has been up and running for over 30 hours and not a single Snort alert in all that time. I just don't understand what the problem is. Can anyone advise?

Thanks…

Do you have any snort rules in the Categories section of snort? If you are using pfsense 1.2.2 version i believe that it's haveing problem updating the rules so you might have to manually download the latest rules from snort.org and do a SSH and also manually install the rules. If you have the latest rules already install than you might have to start the service.