Snort update error (solved)
-
Hello,
since this morning snort fails to update with this error:
Snort Subscriber rules md5 download failed. Server returned error code 422.Anybody else too?
-
Yep, confirm same error with all my three Snort updates during last night.
I investigated the situation.
Environment
pfSense version: 2.8.1
FreeBSD 15.0-CURRENT
Package: pfSense-pkg-snort-4.1.6_28
Snort package version: snort-2.9.20_8
DAQ version: daq-2.2.2_3
Problem descriptionThe Snort rules update process fails when attempting to update the Snort Subscriber Rules.
The update log reports:
[Snort] Server returned error code 422...
[Snort] Snort Subscriber rules md5 download failed.Other rule sources update correctly:
[Snort] Snort AppID Open Text Rules are up to date...
[Snort] Snort GPLv2 Community Rules are up to date...
[Snort] Emerging Threats Open rules are up to date...
[Snort] Feodo Tracker Botnet C2 IP rules file update downloaded successfully.So only the Subscriber Rules update fails.
Troubleshooting performed:
A new OinkCode was generated from the Snort account and configured in pfSense.
The previous OinkCode returned:
["Invalid oinkcode"]
After generating a new OinkCode, authentication was successful.
Manual download test:
curl -L "https://www.snort.org/rules/snortrules-snapshot-29200.tar.gz?oinkcode=<OINKCODE>" -o /tmp/snort.tar.gz
The file downloads successfully.
HTTP response:
HTTP/2 302
location: https://snort-org-site.s3.amazonaws.com/...The generated download URL is valid and the rules archive can be retrieved.
Additional checks
The installed Snort binary reports:
Version 2.9.20 GRE (Build 82) FreeBSD
The pfSense Snort package code generates the rules filename dynamically:
$snortver = str_replace(".", "", SNORT_BIN_VERSION);
$snort_filename = "snortrules-snapshot-{$snortver}.tar.gz";
The generated filename is therefore:
snortrules-snapshot-29200.tar.gz
The archive itself exists and is downloadable.
However, the update process fails while downloading the MD5 file used by the package for verification.
Manual test: curl -L "https://www.snort.org/rules/snortrules-snapshot-29200.tar.gz.md5?oinkcode=<OINKCODE>"
returns: ["File not found by name 'snortrules-snapshot-29200.tar.gz'"]Suspected issue
It appears that Snort.org still provides the Subscriber Rules archive:
snortrules-snapshot-29200.tar.gz
but the corresponding MD5 file expected by the pfSense Snort package is no longer available:
snortrules-snapshot-29200.tar.gz.md5
The pfSense package update mechanism seems to depend on this MD5 file, causing the update process to fail with HTTP 422.
-
@ddepaolis said in Snort update error:
snortrules-snapshot-29200.tar.gz.md5
The pfSense package update mechanism seems to depend on this MD5 file, causing the update process to fail with HTTP 422.
Thanks for investigating! So it seems to be a problem on Snort.org side ...
-
This post is deleted! -
The Snort package uses the MD5 checksum file to test the integrity of the downloaded rules archive. It downloads the archive and associated MD5, computes the MD5 checksum of the downloaded archive locally, then compares that checksum to what was downloaded from the Snort website. If the MD5 does not exist or can't be downloaded, the package logs an error and bails because it cannot verify the integrity of the downloaded rules archive.
Sounds like the problem is on the Snort website end and not an issue with the pfSense package. Give the Snort team a little time and they should correct the missing file. Or someone may have to hit the team up on the Snort mailing list.
But I must take the opportunity to remind Snort users on pfSense that the binary version used is EOL (2.9.x) and the upstream Snort crew has moved to the completely different Snort3 tree. This is much the same as ISC DHCP being deprecated in favor of Kea (upstream I'm talking about). There will certainly come a point where Snort 2.9.x rules will no longer be published by Snort.
-
Thanks for confirm about issue linked to Snort website.
As Snort 3.x is not available as a package for PFSense, I'll plan to migrate to Suricata as IPS, soon.
-
@bmeeks said in Snort update error:
Give the Snort team a little time and they should correct the missing file.
Problem solved by Snort Team. (30.07.2026 20:18 CEST)
Privacy Policy · Cookie Policy