Snort failing to start after loading Snort 4.1.6_12
-
After updating the Snort package to 4.1.6_12 on PFsense 2.7.0-Release I am seeing the following error message when Snort tries to start:
FATAL ERROR: /usr/local/etc/snort/snort_52062_igb1/snort.conf(6) Failed to parse the IP address: [!].
I took a look at some previous posts that mentioned the home net list, it looks normal compared to a system running 4.1.6_11
Any thoughts?
-
@mxkied2 said in Snort failing to start after loading Snort 4.1.6_12:
After updating the Snort package to 4.1.6_12 on PFsense 2.7.0-Release I am seeing the following error message when Snort tries to start:
FATAL ERROR: /usr/local/etc/snort/snort_52062_igb1/snort.conf(6) Failed to parse the IP address: [!].
I took a look at some previous posts that mentioned the home net list, it looks normal compared to a system running 4.1.6_11
Any thoughts?
Me too!
One error for WAN and one for LAN. Here they are:FATAL ERROR: /usr/local/etc/snort/snort_37135_em0/snort.conf(6) Failed to parse the IP address: [!].
FATAL ERROR: /usr/local/etc/snort/snort_45236_em1/snort.conf(6) Failed to parse the IP address: [!].I cannot find either of those SIDs in my enabled categories. I even tried using SID Management to specifically disable those. No change.
Searching for an answer yielded results where the IP address(es) are specified but in this case they are not. What's not parsable? Is that a word?
-
Let me examine this and try to reproduce. I did not encounter it during my testing, but I did make a change in how the $EXTERNAL_NET variable was created.
-
Go apply the fix/workaround I documented here until I get a package update submitted to the Netgate team: https://forum.netgate.com/topic/184077/snort-doesn-t-want-to-start-after-laters-upgrade-to-snort-4-1-6_12/5?_=1699918723493.
-
Thank you! The workaround fixed the issue.
-
@mxkied2 said in Snort failing to start after loading Snort 4.1.6_12:
Thank you! The workaround fixed the issue.
I've posted a new Pull Request for the Netgate developer team to review and merge that contains a permanent fix. It will likely be tomorrow, though, before that merge is completed and a new package built. The new package will be 4.1.6_13.
-
@bmeeks Thank you for being on top of things and getting a fix out so quickly. Your good work doesn't go unnoticed.
