Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login
    Introducing Netgate Nexus: Multi-Instance Management at Your Fingertips.

    Suricata Blocks Page

    Scheduled Pinned Locked Moved Plus 26.03 Snapshots (Retired)
    18 Posts 5 Posters 4.2k Views 6 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S Offline
      skogs
      last edited by skogs

      Webserver reports "50x" error on suricata blocks page.
      Crash report:

      Crash report begins.  Anonymous machine information:

amd64
16.0-CURRENT
FreeBSD 16.0-CURRENT #32 plus-RELENG_26_03-n256526-8d596f10754a: Sun Mar  8 14:44:02 UTC 2026     root@pfsense-build-release-amd64-1.eng.atx.netgate.com:/var/jenkins/workspace/pfSense-Plus-snapshots-26_03-main/obj/amd64/TVcqnR7U/var/jenkins/workspace/pfSe

Crash report details:

PHP Errors:
[13-Mar-2026 22:20:22 America/Denver] PHP Fatal error:  Uncaught ValueError: ip2long(): Argument #1 ($ip) must not contain any null bytes in /etc/inc/util.inc:1440
Stack trace:
#0 /etc/inc/util.inc(1440): ip2long('\x08\xD8\x00d')
#1 /etc/inc/util.inc(1383): is_ipaddrv4('\x08\xD8\x00d')
#2 /usr/local/www/suricata/suricata_blocked.php(399): is_ipaddr('\x08\xD8\x00d')
#3 {main}
  thrown in /etc/inc/util.inc on line 1440



No FreeBSD crash data found.
      S 1 Reply Last reply Reply Quote 0
      • S Offline
        skogs @skogs
        last edited by

        Manually cleared snort2c table from diagnostics page. Suricata blocks page then processed properly.
        Seems to be functioning normally. Maybe it was a simple invalid corruption somehow but I don't know how it occurred; just that it occurred MAYBE at the release candidate update. Potentially some hardware fault that is very conincidental.
        Need a few people to check and try to validate.

        1 Reply Last reply Reply Quote 0
        • stephenw10S Offline
          stephenw10 Netgate Administrator
          last edited by

          I've failed to replicate this so far. Have you seen it happen again?

          If so try to save the block log so we can look for some rogue IP value there.

          S 1 Reply Last reply Reply Quote 0
          • S Offline
            skogs @stephenw10
            last edited by

            @stephenw10
            Was fine for a few days. Seems to have popped just now though.
            Block log incoming as soon as I figure out where it is.

            Crash report begins.  Anonymous machine information:

amd64
16.0-CURRENT
FreeBSD 16.0-CURRENT #32 plus-RELENG_26_03-n256526-8d596f10754a: Sun Mar  8 14:44:02 UTC 2026     root@pfsense-build-release-amd64-1.eng.atx.netgate.com:/var/jenkins/workspace/pfSense-Plus-snapshots-26_03-main/obj/amd64/TVcqnR7U/var/jenkins/workspace/pfSe

Crash report details:

PHP Errors:
[18-Mar-2026 16:12:58 America/Denver] PHP Fatal error:  Uncaught ValueError: ip2long(): Argument #1 ($ip) must not contain any null bytes in /etc/inc/util.inc:1440
Stack trace:
#0 /etc/inc/util.inc(1440): ip2long('U\xD9\x95\x00')
#1 /etc/inc/util.inc(1383): is_ipaddrv4('U\xD9\x95\x00')
#2 /usr/local/www/suricata/suricata_blocked.php(399): is_ipaddr('U\xD9\x95\x00')
#3 {main}
  thrown in /etc/inc/util.inc on line 1440



No FreeBSD crash data found.
            1 Reply Last reply Reply Quote 0
            • stephenw10S Offline
              stephenw10 Netgate Administrator
              last edited by

              Directly it should be: /var/log/suricata/<interface>/block.log

              But you can probably also check it in the Suricata log viewer tab.

              S 1 Reply Last reply Reply Quote 0
              • S Offline
                skogs @stephenw10
                last edited by

                @stephenw10
                yeah was looking through them and didn't see anything obvious.

                3 interfaces so 3 files; lots of things I've suppressed but still seem to process. Rather annoying. I look at logs of a living. Just not these logs. Perhaps a more skilled eye will see something useful. Seems rude to abuse your good will though.

                suricata.zip

                1 Reply Last reply Reply Quote 0
                • stephenw10S Offline
                  stephenw10 Netgate Administrator
                  last edited by

                  Thanks, I'll see what we can find.

                  One thing you might check is whether there are any IPv6 addresses listed when the page is working as expected. So clear it, wait for some blocks, check for v6 IPs.
                  IPv6 is still, unfortunately, far less used/tested for this.

                  S 1 Reply Last reply Reply Quote 0
                  • S Offline
                    skogs @stephenw10
                    last edited by skogs

                    @stephenw10

                    Just ate it again. Obviously a much shorter log this time. Zero IPv6 in the log.

                    I used to run IPv6 but got rather annoyed with the local dhcp management of it when we swapped the dhcp server a year or so back. External has no IPv6 so much less traffic than it used to be.

                    Crash report begins.  Anonymous machine information:

amd64
16.0-CURRENT
FreeBSD 16.0-CURRENT #32 plus-RELENG_26_03-n256526-8d596f10754a: Sun Mar  8 14:44:02 UTC 2026     root@pfsense-build-release-amd64-1.eng.atx.netgate.com:/var/jenkins/workspace/pfSense-Plus-snapshots-26_03-main/obj/amd64/TVcqnR7U/var/jenkins/workspace/pfSe

Crash report details:

PHP Errors:
[18-Mar-2026 18:39:07 America/Denver] PHP Fatal error:  Uncaught ValueError: ip2long(): Argument #1 ($ip) must not contain any null bytes in /etc/inc/util.inc:1440
Stack trace:
#0 /etc/inc/util.inc(1440): ip2long('\x14\xA8\x00-')
#1 /etc/inc/util.inc(1383): is_ipaddrv4('\x14\xA8\x00-')
#2 /usr/local/www/suricata/suricata_blocked.php(399): is_ipaddr('\x14\xA8\x00-')
#3 {main}
  thrown in /etc/inc/util.inc on line 1440



No FreeBSD crash data found.

                    block.log.txt

                    1 Reply Last reply Reply Quote 0
                    • stephenw10S Offline
                      stephenw10 Netgate Administrator
                      last edited by

                      Hmm, nothing unusual there I can see.

                      Maybe it's logged correctly but not in the actual block list. Check Diag > Tables > snort2c

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S Offline
                        stephenw10 Netgate Administrator
                        last edited by

                        Or perhaps the SURICATA_PF_TABLE table.

                        1 Reply Last reply Reply Quote 0
                        • stephenw10S Offline
                          stephenw10 Netgate Administrator
                          last edited by

                          Just to confirm this is something you saw only after upgrading to 26.03?

                          1 Reply Last reply Reply Quote 0
                          • S Offline
                            skogs
                            last edited by

                            Definitely never happened before bumping to the RC. Trouble is nothing really makes sense to have caused it.

                            The snort2c table looks normal. No stray digits or randomness. No IPv6. Still had trouble with the page today. Not a blocker really as it is just the suricata page. Just strange and worth reporting.

                            3 1 Reply Last reply Reply Quote 1
                            • 3 Offline
                              3aandl @skogs
                              last edited by

                              @skogs Seeing the same thing here. Never happened before

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S Offline
                                stephenw10 Netgate Administrator
                                last edited by

                                There's a patch for this here: https://redmine.pfsense.org/issues/16771#note-3

                                3 P 2 Replies Last reply Reply Quote 0
                                • 3 Offline
                                  3aandl @stephenw10
                                  last edited by

                                  @stephenw10 Thanks! I literally just found the patch about 5 mins before I say your post.

                                  1 Reply Last reply Reply Quote 1
                                  • P Offline
                                    Petrixx @stephenw10
                                    last edited by

                                    @stephenw10 Sorry, but how do I apply this patch? copy / paste somewhere?

                                    SteveITSS 1 Reply Last reply Reply Quote 0
                                    • SteveITSS Offline
                                      SteveITS Rebel Alliance @Petrixx
                                      last edited by

                                      @Petrixx using https://docs.netgate.com/pfsense/en/latest/development/system-patches.html.

                                      Add a patch and paste in the code, then apply. IIRC all the defaults are OK.

                                      To upgrade, select your branch in System/Update/Update Settings. When upgrading, allow 10-15 minutes to reboot, or more depending on packages, CPU, and/or disk speed.
                                      Only install packages for your version of pfSense.
                                      Upvote 👍 helpful posts!

                                      P 1 Reply Last reply Reply Quote 1
                                      • P Offline
                                        Petrixx @SteveITS
                                        last edited by

                                        @SteveITS - perfect. Thank you.

                                        1 Reply Last reply Reply Quote 0
                                        • First post
                                          Last post
                                        Copyright 2026 Rubicon Communications LLC (Netgate). All rights reserved.
                                        Privacy Policy · Cookie Policy