Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort, problem with startup services

    Scheduled Pinned Locked Moved pfSense Packages
    16 Posts 3 Posters 6.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      simby
      last edited by

      After fresh install PF 1.2.3 with snort beta (or normal), i can t started the service. What could be the problem?

      I have P4 2.8MHz, 3GB ram,… before it works OK,... only the difference is, new rules/category.

      How can i add more memory to snort? Do i need any change to done in config file?

      Thanks for your support

      LOG FILE:

      Dec 26 07:39:08 SnortStartup[62064]: MEM after 0em1 START 63M
      Dec 26 07:39:08 SnortStartup[62059]: Snort HARD Reload For 0em1…
      Dec 26 07:39:08 syslogd: kernel boot file is /boot/kernel/kernel
      Dec 26 07:38:44 syslogd: kernel boot file is /boot/kernel/kernel
      Dec 26 07:38:44 syslogd: exiting on signal 15
      Dec 26 07:37:34 SnortStartup[61568]: MEM after 0em1 START 62M
      Dec 26 07:37:34 SnortStartup[61563]: Snort HARD Reload For 0em1…
      Dec 26 07:37:34 syslogd: kernel boot file is /boot/kernel/kernel
      Dec 26 07:36:39 SnortStartup[60939]: MEM after 0em1 START 63M
      Dec 26 07:36:39 SnortStartup[60934]: Snort HARD Reload For 0em1…

      1 Reply Last reply Reply Quote 0
      • J
        jamesdean
        last edited by

        @simby:

        After fresh install PF 1.2.3 with snort beta (or normal), i can t started the service. What could be the problem?

        I have P4 2.8MHz, 3GB ram,… before it works OK,... only the difference is, new rules/category.

        How can i add more memory to snort? Do i need any change to done in config file?

        Thanks for your support

        LOG FILE:

        Dec 26 07:39:08 SnortStartup[62064]: MEM after 0em1 START 63M
        Dec 26 07:39:08 SnortStartup[62059]: Snort HARD Reload For 0em1…
        Dec 26 07:39:08 syslogd: kernel boot file is /boot/kernel/kernel
        Dec 26 07:38:44 syslogd: kernel boot file is /boot/kernel/kernel
        Dec 26 07:38:44 syslogd: exiting on signal 15
        Dec 26 07:37:34 SnortStartup[61568]: MEM after 0em1 START 62M
        Dec 26 07:37:34 SnortStartup[61563]: Snort HARD Reload For 0em1…
        Dec 26 07:37:34 syslogd: kernel boot file is /boot/kernel/kernel
        Dec 26 07:36:39 SnortStartup[60939]: MEM after 0em1 START 63M
        Dec 26 07:36:39 SnortStartup[60934]: Snort HARD Reload For 0em1…

        Try to start the serves manually and post the error.

        1 Reply Last reply Reply Quote 0
        • S
          simby
          last edited by

          Is this ok? :)

          Thanks for helping me James

          –== Initializing Snort ==--
          Initializing Output Plugins!       
          Initializing Preprocessors!       
          Initializing Plug-ins!             
          Parsing Rules file /usr/local/etc/snort/snort.conf
          PortVar 'HTTP_PORTS' defined :  [ 80 2301 3128 7777 7779 8000 8008 8028 8080 8180 8888 9999 ]
          PortVar 'SHELLCODE_PORTS' defined :  [ any ]                                               
          PortVar 'ORACLE_PORTS' defined :  [ 1024:65535 ]                                           
          PortVar 'AUTH_PORTS' defined :  [ 113 ]                                                     
          PortVar 'DNS_PORTS' defined :  [ 53 ]                                                       
          PortVar 'FINGER_PORTS' defined :  [ 79 ]                                                   
          PortVar 'FTP_PORTS' defined :  [ 21 ]                                                       
          PortVar 'IMAP_PORTS' defined :  [ 143 ]                                                     
          PortVar 'IRC_PORTS' defined :  [ 6665:6669 7000 ]                                           
          PortVar 'MSSQL_PORTS' defined :  [ 1433 ]                                                   
          PortVar 'NNTP_PORTS' defined :  [ 119 ]                                                     
          PortVar 'POP2_PORTS' defined :  [ 109 ]                                                     
          PortVar 'POP3_PORTS' defined :  [ 110 ]                                                     
          PortVar 'SUNRPC_PORTS' defined :  [ 111 32770:32779 ]                                       
          PortVar 'RLOGIN_PORTS' defined :  [ 513 ]                                                   
          PortVar 'RSH_PORTS' defined :  [ 514 ]                                                     
          PortVar 'SMB_PORTS' defined :  [ 139 445 ]                                                 
          PortVar 'SMTP_PORTS' defined :  [ 25 ]                                                     
          PortVar 'SNMP_PORTS' defined :  [ 161 ]                                                     
          PortVar 'SSH_PORTS' defined :  [ 22 ]                                                       
          PortVar 'TELNET_PORTS' defined :  [ 23 ]                                                   
          PortVar 'MAIL_PORTS' defined :  [ 25 143 465 691 ]                                         
          PortVar 'SSL_PORTS' defined :  [ 25 443 465 636 993 995 ]                                   
          PortVar 'DCERPC_NCACN_IP_TCP' defined :  [ 139 445 ]                                       
          PortVar 'DCERPC_NCADG_IP_UDP' defined :  [ 138 1024:65535 ]                                 
          PortVar 'DCERPC_NCACN_IP_LONG' defined :  [ 135 139 445 593 1024:65535 ]                   
          PortVar 'DCERPC_NCACN_UDP_LONG' defined :  [ 135 1024:65535 ]                               
          PortVar 'DCERPC_NCACN_UDP_SHORT' defined :  [ 135 593 1024:65535 ]                         
          PortVar 'DCERPC_NCACN_TCP' defined :  [ 2103 2105 2107 ]                                   
          PortVar 'DCERPC_BRIGHTSTORE' defined :  [ 6503:6504 ]                                       
          Detection:                                                                                 
            Search-Method = AC-BNFA-Q                                                               
          Frag3 global config:                                                                       
              Max frags: 65536                                                                       
              Fragment memory cap: 4194304 bytes                                                     
          Frag3 engine config:                                                                       
              Target-based policy: WINDOWS                                                           
              Fragment timeout: 180 seconds                                                           
              Fragment min_ttl:  1                                                                   
              Fragment ttl_limit (not used): 5                                                       
              Fragment Problems: 0                                                                   
          Stream5 global config:                                                                     
              Track TCP sessions: ACTIVE                                                             
              Max TCP sessions: 8192                                                                 
              Memcap (for reassembly packet storage): 8388608                                         
              Track UDP sessions: ACTIVE                                                             
              Max UDP sessions: 131072                                                               
              Track ICMP sessions: INACTIVE                                                           
              Log info if session memory consumption exceeds 1048576                                 
          Stream5 TCP Policy config:                                                                 
              Reassembly Policy: WINDOWS                                                             
              Timeout: 30 seconds                                                                     
              Min ttl:  1                                                                             
              Maximum number of bytes to queue per session: 1048576                                   
              Maximum number of segs to queue per session: 2621                                       
              Options:                                                                               
                  Static Flushpoint Sizes: YES                                                       
              Reassembly Ports:                                                                       
                21 client (Footprint)                                                                 
                22 client (Footprint)                                                                 
                23 client (Footprint)                                                                 
                25 client (Footprint)                                                                 
                42 client (Footprint)                                                                 
                53 client (Footprint)                                                                 
                79 client (Footprint)                                                                 
                80 client (Footprint)                                                                 
                109 client (Footprint)                                                               
                110 client (Footprint)                                                               
                111 client (Footprint)                                                               
                113 client (Footprint)                                                               
                119 client (Footprint)                                                               
                135 client (Footprint)                                                               
                136 client (Footprint)                                                               
                137 client (Footprint)                                                               
                139 client (Footprint)                                                               
                143 client (Footprint)                                                               
                161 client (Footprint)                                                               
                443 client (Footprint) server (Footprint)                                             
          Stream5 UDP Policy config:                                                                 
              Timeout: 30 seconds                                                                     
              Options:                                                                               
                  Ignore Any -> Any Rules: YES                                                       
          HttpInspect Config:
              GLOBAL CONFIG
                Max Pipeline Requests:    0
                Inspection Type:          STATELESS
                Detect Proxy Usage:      NO
                IIS Unicode Map Filename: /usr/local/etc/snort/unicode.map
                IIS Unicode Map Codepage: 1252
              DEFAULT SERVER CONFIG:
                Server profile: All
                Ports: 80 2301 3128 7777 7779 8000 8008 8028 8080 8180 8888 9999
                Server Flow Depth: 1460
                Client Flow Depth: 300
                Max Chunk Length: 500000
                Max Header Field Length: 0
                Max Number Header Fields: 0
                Inspect Pipeline Requests: YES
                URI Discovery Strict Mode: NO
                Allow Proxy Usage: NO
                Disable Alerting: NO
                Oversize Dir Length: 500
                Only inspect URI: NO
                Normalize HTTP Headers: NO
                Normalize HTTP Cookies: NO
                Ascii: YES alert: NO
                Double Decoding: YES alert: NO
                %U Encoding: YES alert: YES
                Bare Byte: YES alert: NO
                Base36: OFF
                UTF 8: YES alert: NO
                IIS Unicode: YES alert: NO
                Multiple Slash: YES alert: NO
                IIS Backslash: YES alert: NO
                Directory Traversal: YES alert: NO
                Web Root Traversal: YES alert: NO
                Apache WhiteSpace: YES alert: NO
                IIS Delimiter: YES alert: NO
                IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG
                Non-RFC Compliant Characters: 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07
                Whitespace Characters: 0x09 0x0b 0x0c 0x0d
          rpc_decode arguments:
              Ports to decode RPC on: 111 32770 32771 32772 32773 32774 32775 32776 32777 32778 32779
              alert_fragments: INACTIVE
              alert_large_fragments: ACTIVE
              alert_incomplete: ACTIVE
              alert_multiple_requests: ACTIVE
          ERROR: Unable to open rules file: ../rules/local.rules or /usr/local/etc/snort/../rules/local.rules
          Fatal Error, Quitting..

          1 Reply Last reply Reply Quote 0
          • J
            jamesdean
            last edited by

            simby

            Sorry, this all my fault.

            There is a bug in snort-dev, rule files are not being copied over after updates.
            Rules are only being copied after interface creation.

            Fix

            Manually copy "cp /usr/local/etc/snort/rules* /usr/local/etc/snort/snort_myinterface/rules

            or

            Delete all your interfaces.
            Update your rules.
            Create your interfaces.

            Merry Christmas
            James

            1 Reply Last reply Reply Quote 0
            • S
              simby
              last edited by

              Thanks, fixed now. Do i need to do this on every update of snort rules?

              1 Reply Last reply Reply Quote 0
              • S
                simby
                last edited by

                now i have this problem:

                Loading dynamic engine /usr/local/lib/snort_dynamicengine/libsf_engine.so… ERROR: Failed to load /usr/local/lib/snort_dynamicengine/libsf_engine.so: Cannot open "/usr/local/lib/snort_dynamicengine/libsf_engine.so"
                Fatal Error, Quitting..

                1 Reply Last reply Reply Quote 0
                • J
                  jamesdean
                  last edited by

                  @simby:

                  now i have this problem:

                  Loading dynamic engine /usr/local/lib/snort_dynamicengine/libsf_engine.so… ERROR: Failed to load /usr/local/lib/snort_dynamicengine/libsf_engine.so: Cannot open "/usr/local/lib/snort_dynamicengine/libsf_engine.so"
                  Fatal Error, Quitting..

                  Reinstall the snort-dev package I added code today.

                  Fallow my changes at https://rcs.pfsense.org/users/robiscool

                  James

                  1 Reply Last reply Reply Quote 0
                  • S
                    simby
                    last edited by

                    Thanks!!! & for link :)

                    1 Reply Last reply Reply Quote 0
                    • T
                      ToxIcon
                      last edited by

                      pfsense 1.2.3-RELEASE
                      snort-dev  2.8.4.1_7 pkg v. 1.8

                      short Rules tab error:
                      please work Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/snort/snort_rules.php:390) in /usr/local/www/guiconfig.inc on line 35 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/snort/snort_rules.php:390) in /usr/local/www/guiconfig.inc on line 36 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/snort/snort_rules.php:390) in /usr/local/www/guiconfig.inc on line 37 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/snort/snort_rules.php:390) in /usr/local/www/guiconfig.inc on line 38 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/snort/snort_rules.php:390) in /usr/local/www/guiconfig.inc on line 39

                      cant save/apply enable new rules

                      snort to dashboard  gives 404 - Not Found

                      1 Reply Last reply Reply Quote 0
                      • J
                        jamesdean
                        last edited by

                        @ToxIcon:

                        pfsense 1.2.3-RELEASE
                        snort-dev  2.8.4.1_7 pkg v. 1.8

                        short Rules tab error:
                        please work Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/snort/snort_rules.php:390) in /usr/local/www/guiconfig.inc on line 35 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/snort/snort_rules.php:390) in /usr/local/www/guiconfig.inc on line 36 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/snort/snort_rules.php:390) in /usr/local/www/guiconfig.inc on line 37 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/snort/snort_rules.php:390) in /usr/local/www/guiconfig.inc on line 38 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/snort/snort_rules.php:390) in /usr/local/www/guiconfig.inc on line 39

                        cant save/apply enable new rules

                        snort to dashboard  gives 404 - Not Found

                        Updated code…...
                        Am all done with snort_blocked.php and snort_alerts.php.

                        snort_rules.php is to slow.

                        Im adding code to make it faster.

                        James

                        1 Reply Last reply Reply Quote 0
                        • S
                          simby
                          last edited by

                          On alerts blocked we have this error:

                          Warning: array_unique(): The argument should be an array in /usr/local/www/snort/snort_blocked.php on line 345 Warning: Invalid argument supplied for foreach() in /usr/local/www/snort/snort_blocked.php on line 350 ;)

                          1 Reply Last reply Reply Quote 0
                          • J
                            jamesdean
                            last edited by

                            I have just tested and the code works.

                            Do you have the latest code ?

                            Do you have alerts that are not blocked ?

                            James

                            1 Reply Last reply Reply Quote 0
                            • S
                              simby
                              last edited by

                              Yes, i have the last code from today,… i will add you later picture.

                              1 Reply Last reply Reply Quote 0
                              • S
                                simby
                                last edited by

                                Picture,… can you please fix this log reporting to fix the new theme :)

                                snapshot1.png
                                snapshot1.png_thumb
                                snapshot2.png
                                snapshot2.png_thumb

                                1 Reply Last reply Reply Quote 0
                                • J
                                  jamesdean
                                  last edited by

                                  @simby:

                                  Picture,… can you please fix this log reporting to fix the new theme :)

                                  Updated code to deal with corrupted alerts file, said error should be fixed now.

                                  Now Im working on snort_rules.php trying to make it faster.

                                  James

                                  1 Reply Last reply Reply Quote 0
                                  • T
                                    ToxIcon
                                    last edited by

                                    snort-dev 2.8.4.1_7 pkg v. 1.8

                                    PROTO:255  (portscan) UDP Filtered Portsweep  Prep  x.x.x.x  empty  ->  x.x.x.x  empty  122:23:0  01/03-16:46:06

                                    what snort rule triggers the alert above

                                    1 Reply Last reply Reply Quote 0
                                    • First post
                                      Last post
                                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.