Snort inilization failure



  • Hi, Just 'd like to ask what's the status here with the issue ?

    my pfsense is 1.0.1
    Last time it was with 1.0-RC3 when snort caused network problem
    and it was quite a headache to try to find out what's wrong till
    we have to take off snort all together.

    I assume then 6.2 RC1 ( Scott's earlier link ) + snort works alright ?

    I have more than 1 G ram for pfsense.

    Cheers,



  • Snort works. Its just the initialization process I am experiencing issues with. I don't believe everyone is experiencing it. Once snort initializes successfully it works great. You can run a port scan on your firewall and you will see it in the logs.



  • @yoda715:

    Snort works. Its just the initialization process I am experiencing issues with. I don't believe everyone is experiencing it. Once snort initializes successfully it works great. You can run a port scan on your firewall and you will see it in the logs.

    aah Ok, thanks yoda715

    gl for that



  • @yoda715:

    Still experiencing the same issue. Had to click save after reinstall and reboot to get Snort to startup. Any luck PC_Arcade?

    Same behaviour with just the package update, I'll try the pfsense update later and report back



  • I didn't see any different behavior until I updated to the latest snapshot. Then snort would get stuck in an infinite initialization loop.



  • I'm loathe to install the newer build, because it looks like all it is doing is forcing a restart of snort and that will, as you point out, cause an infinite loop as there is a problem with the initialisation which causes it to bomb out.



  • @yoda715:

    I didn't see any different behavior until I updated to the latest snapshot. Then snort would get stuck in an infinite initialization loop.

    Thats funny.  I haven't changed anything…  All that the new image contains is FreeBSD 6.2.



  • I can confirm that under the new version, the results are exactly the same.

    After a while snort exits with a core dump (it doesn't reload)



  • I can still provide a configuration file to help out, if you wish .



  • I had the same problem for awhile….snort always ending in a core dump. (I have 1 gig of ram installed)...What finally did the trick for me was switching from ac sparsebands to just acs.......no more core dumping. Has been up for the past week with no problems.



  • @ColdFusion:

    I had the same problem for awhile….snort always ending in a core dump. (I have 1 gig of ram installed)...What finally did the trick for me was switching from ac sparsebands to just acs.......no more core dumping. Has been up for the past week with no problems.

    ;D …and after all that, it looks like acs is the key. certainly been up now for longer than normal, AND it's consuming less memory too



  • I changed my snort performance to acs as well. I am still seeing snort failing to bootup completely immediately after a reboot. However, it will start the initialization process over once it fails. On the second initialization, Snort will successfully boot up.

    So I've done some more testing.

    Using the performance modes ac, ac-std, or ac-sparebands I get snort initialization failures and core dumps when I reboot. I cannot get snort to boot until I click save in settings.

    If I use acs or lowmem, they appear to boot up fine.

    Question is, why?



  • It's funny I couldn't figure it either, I tried them all but acs worked consistently well. I'm using about 10% less ram also. The alerts are also triggering consistently better also. I'm running snort+squid, I wonder if all this is related to squid. Did anybody have this problem(core dumping) with just snort installed and not squid?



  • Yep, me. I've only been running SNORT.

    Although I will add Squid as soon as it becomes available again.

    acs uses significantly less memory for me too and also works as intended. Thank coldfusion



  • @yoda715:

    Question is, why?

    No idea.  This is now a SNORT issue and this should be asked on their lists.



  • I think the latest version of SNORT (2.6.1.1) fixes this issue



  • Not sure if this fixes our issue.

    This is the issue solved in 2.6.1.1: "Fix problem with snort using high CPU and reprocessing the same rebuilt packets at session end or ACK in middle of packet when there are gaps in the packet sequence."



  • certainly seems to :)

    Running in sparsebands now, only been up for ~5 minutes, but that's ~3 more than I've managed before



  • I updated to the 2.6.1.1 versions and now I cant even get Snort to boot up on any performance setting. I am getting brand new errors now:

    Nov 24 14:53:39 snort2c[1571]: unable to open alertfile - exit
    Nov 24 14:53:39 snort2c[1571]: unable to open alertfile - exit
    Nov 24 14:53:39 snort2c[1571]: snort2c running in daemon mode pid: 1571
    Nov 24 14:53:39 snort2c[1571]: snort2c running in daemon mode pid: 1571

    I am running the 1.0.1-SNAPSHOT-11-24-2006



  • Oh bugger.  I'll check it out a bit later tonite.



  • Thanks Scott.



  • Didn't do that for me, BUT it also didn't trigger any alerts



  • Try running a port scan from http://www.grc.com. You should see it appear in alert as a ping.



  • I'm pretty much screwed with the same alert after I upgraded SNORT. Now the service will not start and stay running.



  • Scott, I see where you reverted snort back to the 2.6.0.2.5. I reverted back to that version and I'm still getting the same error. The trouble must be in the latest snapshot.



  • @yoda715:

    Try running a port scan from http://www.grc.com. You should see it appear in alert as a ping.

    I know, and it doesn't.

    I've reverted back to the older version and it still doesn't raise any alerts at all  ???



  • What snapshot are you running? I'm thinking it has something to do with that since I too reverted back to the older version of snort.



  • Version 1.01



  • @yoda715:

    What snapshot are you running? I'm thinking it has something to do with that since I too reverted back to the older version of snort.

    1.0.1-SNAPSHOT-11-19-2006



  • Well, it boiled down to me just re-installing pfSense(1.01) and re-installing SNORT. It started fine. I kept getting could not open alert file…..no matter what I did.......but now (keeping my fingers crossed) everything looks good.



  • I think I'd rather do without snort than re-install from scratch



  • Backup your configuration, reinstall, restore configuration.

    It takes about 6 minutes on a 800 mhz machine.



  • If you backup your configuration to a media (floppy/USB stick) to /conf/config.xml your users will only see 2 short downtimes while the pfSense is rebooting. The livecd will come up with your old config and the system will be usable while you are installing it to the hdd  ;)



  • Thanks Hoba, I'll give that a try later.

    Oh, Fyi everyone, I've taken on a little issue I saw with snort. I've been wanting an easy way to enable, disable, and edit snort rules. So I've started workin on this. It's not done yet, but the screenshot below shows the progress I've made in the last day.

    Right now I've got it to list the rules in a cleaner format, but they are not yet editable.

    Enjoy.

    ![snort rules.JPG](/public/imported_attachments/1/snort rules.JPG)
    ![snort rules.JPG_thumb](/public/imported_attachments/1/snort rules.JPG_thumb)
    ![snort rules.JPG_thumb](/public/imported_attachments/1/snort rules.JPG_thumb)



  • @yoda715:

    Thanks Hoba, I'll give that a try later.

    Oh, Fyi everyone, I've taken on a little issue I saw with snort. I've been wanting an easy way to enable, disable, and edit snort rules. So I've started workin on this. It's not done yet, but the screenshot below shows the progress I've made in the last day.

    Right now I've got it to list the rules in a cleaner format, but they are not yet editable.

    Enjoy.

    Nice!



  • Thanks. I plan on having it look very similar to the firewall rules. Right now functionality is what I am focusing on. Then I will make it look pretty :).



  • ~~No go for me.

    I've tried everything.

    Fresh install of 1.0.1. No config file uploaded. Downloaded snort, enter info, and nothing starts up. I'm not getting the error "can't read alert file", but snort is not starting up.~~

    Nevermind, it helps to enable rules. all good now :).



  • If I upgrade to the latest snapshot from 1.0.1 with snort already installed, I get unable to open alert file errors.



  • Ok. I am totally perplexed here. I can't get snort running at all now. After upgrading to the 11-29 snapshot last night, I got unable to open snort alert file errors.

    So I reinstalled 1.0.1, did not import config, installed snort, entered the snort code, etc, and now it won't start up.

    I've downloaded the rules, enabled them, etc. Still nothing :(.

    Also, when I upgraded to 11-29 snapshot, it took FOREVER. I'm talking about an hour and a half to upload the file before I got the prompt to install the firmware. I have never gotten that type of response before.

    Anyone else having these issues?

    Here's the log error Im getting with 1.0.1 and snort 2.6.0.2.5

    Nov 30 22:27:46 snort[17160]: Daemon parent exiting
    Nov 30 22:27:46 snort[17160]: Daemon parent exiting
    Nov 30 22:27:46 snort[17160]: Child exited unexpectedly
    Nov 30 22:27:46 snort[17160]: Child exited unexpectedly
    Nov 30 22:27:45 snort[17176]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_sis0.pid" for PID "17176"
    Nov 30 22:27:45 snort[17176]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_sis0.pid" for PID "17176"
    Nov 30 22:27:45 snort[17176]: PID path stat checked out ok, PID path set to /var/run/
    Nov 30 22:27:45 snort[17176]: PID path stat checked out ok, PID path set to /var/run/



  • Not sure about that one unless FreeBSD 6.2 is causing the issue.  I'm sorta tied up at the moment but will check into it as soon as I get some free cycles.


Log in to reply