Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    SNORT install broken? (PFS 1.2.3)

    Scheduled Pinned Locked Moved pfSense Packages
    8 Posts 4 Posters 4.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • cyber7C
      cyber7
      last edited by

      Hi Guys
      I have over the last 3 days been trying to install SNORT on both release 2 and 1.2.3, with the same results:

      At the point where SNORT-INSTALL does the:
      Installing perl-threaded for x86…
      the installation says:
      Please wait downloading...
      after downloading about 24MB of info, NOTHING HAPPENS.
      This occures both on BETA 2 and Release 1.2.3
      I have left it over-night, but NOTHING...

      Additional testing:
      1. after waiting for the connection to 66.111.2.166 to close, I have been able to get to some of the structure of the php files by filling them into the browser
      (for example: http://x.x.x.x/snort/snort_interfaces_global.php)
      and some of the display does come back, but I have not seen a MENUITEM anywhere.
      2. I have looked into the /cf configuration file and can see some of the structure of the snort menu-item in the INSTALLED ITEMS, but even looking in the PACKAGES (Installed) of the pfSence interface, it always shows SNORT as uninstalled...

      What gives?
      cheers
      cyber7

      When you pause to think, do you start again?

      2.2.4-RELEASE (amd64)
      built on Sat Jul 25 19:57:37 CDT 2015
      FreeBSD 10.1-RELEASE-p15
      and
      pfSense 2.3.2-RELEASE-p1 (amd64 full-install) on pfSense

      1 Reply Last reply Reply Quote 0
      • D
        darklogic
        last edited by

        Here is a question? Did you reboot the system before the install. Check your services and make sure you do not appear to have 2 SNORT service entries under services. Uninstall SNORT, reboot, install again, and then reboot again.

        Try that.

        Take Care

        1 Reply Last reply Reply Quote 0
        • cyber7C
          cyber7
          last edited by

          hi DarkLogic
          Yes, I have rebooted before and after.

          I do not have a UNINSTALL option in packages, but have done a manual pkg_delete (snort-2.8.6.1 shows with pkg_info)

          One concern, though, on pkg_info I see 2 perl (5.10.1_1 and 5.8.8_1) installed?

          I will report back.
          Cheers
          cyber7

          When you pause to think, do you start again?

          2.2.4-RELEASE (amd64)
          built on Sat Jul 25 19:57:37 CDT 2015
          FreeBSD 10.1-RELEASE-p15
          and
          pfSense 2.3.2-RELEASE-p1 (amd64 full-install) on pfSense

          1 Reply Last reply Reply Quote 0
          • cyber7C
            cyber7
            last edited by

            more info from my console:

            pkg_info

            cyrus-sasl-2.1.23  RFC 2222 SASL (Simple Authentication and Security Layer)
            db41-4.1.25_4      The Berkeley DB package, revision 4.1
            gd-2.0.35,1        A graphics library for fast creation of images
            grub-0.97_3        GRand Unified Bootloader
            jpeg-6b_4          IJG's jpeg compression utilities
            mysql-client-5.1.50_1 Multithreaded SQL database (client)
            openldap-client-2.4.22 Open source LDAP client implementation
            p5-GD-2.39          A perl5 interface to Gd Graphics Library version2
            packages            BSD Installer mega-package
            pcre-8.10          Perl Compatible Regular Expressions library
            perl-5.10.1_1      Practical Extraction and Report Language
            perl-5.8.8_1        Practical Extraction and Report Language
            perl-threaded-5.12.1_1 Practical Extraction and Report Language
            snort-2.8.6.1      Lightweight network intrusion detection system

            pkg_delete snort-2.8.6.1

            pkg_delete: file '/usr/local/etc/snort/classification.config-sample' doesn't exist
            pkg_delete: file '/usr/local/etc/snort/gen-msg.map-sample' doesn't exist
            pkg_delete: file '/usr/local/etc/snort/reference.config-sample' doesn't exist
            pkg_delete: file '/usr/local/etc/snort/sid-msg.map-sample' doesn't exist
            pkg_delete: file '/usr/local/etc/snort/snort.conf-sample' doesn't exist
            pkg_delete: file '/usr/local/etc/snort/threshold.conf-sample' doesn't exist
            pkg_delete: file '/usr/local/etc/snort/unicode.map-sample' doesn't exist
            pkg_delete: file '/usr/local/etc/rc.d/snort' doesn't exist
            pkg_delete: couldn't entirely delete package (perhaps the packing list is
            incorrectly specified?)

            When you pause to think, do you start again?

            2.2.4-RELEASE (amd64)
            built on Sat Jul 25 19:57:37 CDT 2015
            FreeBSD 10.1-RELEASE-p15
            and
            pfSense 2.3.2-RELEASE-p1 (amd64 full-install) on pfSense

            1 Reply Last reply Reply Quote 0
            • J
              jamesdean
              last edited by

              cyber7

              What are your system specs ?

              James

              1 Reply Last reply Reply Quote 0
              • cyber7C
                cyber7
                last edited by

                system spec:
                2 * XEON quad
                4 * eth
                26 GIG mem
                4TB HDD

                cheers
                cyber7

                When you pause to think, do you start again?

                2.2.4-RELEASE (amd64)
                built on Sat Jul 25 19:57:37 CDT 2015
                FreeBSD 10.1-RELEASE-p15
                and
                pfSense 2.3.2-RELEASE-p1 (amd64 full-install) on pfSense

                1 Reply Last reply Reply Quote 0
                • J
                  jambek2003
                  last edited by

                  I've got exactly the same problem! 2.8.6.1 didn't update. couldn't find any packages for snort besides snort-old. Installed old, didn't work with oink-code. removed snort-old. Saw snort back again in packagelist. now I try to install 2.8.6.1 v1.35 and Just see "Installing perl-threaded for x86… Please wait Installing..." and that's it. Updated pfSense to same release 1.2.3 didn't help. Restored to xml-file which i saved without packages.... no luck!

                  Edit did a cfg_info after that removed cfg_delete snort, pcre and pecl. Still Snort 2.6.8.1 v1.34 when I go to url; http://x.x.x.x/snort/snort_interfaces_global.php. I've updated my system and packages are back but still no

                  1 Reply Last reply Reply Quote 0
                  • J
                    jambek2003
                    last edited by

                    I did a fresh install of pfSense-1.2.3. Try to Install Snort-2.8.6.1. interface just shows "Installing perl-threaded for x86… Please wait Installing..."

                    I can configure snort just by URL. Snort is running and logs alerts and attempts to systemlog. Only snort isn't in the services-sevtion nor in submenu as snort neither in "installed packages". According to browserwindows snort has version 2.8.6.1 v1.34 but i downloaded version 1.35 from packageslist. something is really broken here! A fix please.

                    hardware;
                    PIII600, Intel440BX-chipset, 512MB sdram, 512MB compactflash Transcend UDMA with IDE2CF-convertor, 3x 3Com ? (xl-drivers).

                    1 Reply Last reply Reply Quote 0
                    • First post
                      Last post
                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.