Duplicate Interface Help

kilthro

I have been experiencing a problem that I dont know how to correct (if it is fixable) and was hoping someone could help.

I am running on the current beta version and this has happened since the 9/17 build (first time with pfsense). This may also be a problem with the snort package directly. If so, please move the topic.

As the title says, I am getting a duplicate WAN interface. I have two netgear gigabit cards. RE0 is wan and RE1 is the lan. Everything works fine until I configure snort in the global settings when its already set up to monitor the WAN interface. After I apply the settings, I will notice that in the interface menu in pfsense I will have three interfaces instead of 2. I will have the wan interface listed wich is what i originally configured RE0 to be and then a Lan interface that I configued re1 to be. Then at the bottom of the list another RE0 appears. it does have the option to change what physical card to select in the pull down either RE0(wan) or re1 (lan). The big problem here is, I cant delete the RE0 entry and if I reboot, I get a never ending network interface mismatch error and it wants me to reset up the interfaces like it does when you first install the firewall. Unfortunately it never completes that state and keeps asking me to set it up over and over.
When trying to delete the entry via the interface menu i get
Fatal error: Cannot unset string offsets in /usr/local/www/interfaces_assign.php on line 25
I have even tried disabling the wan interface and deleting it and still same error.

After a long process of package isololation it seems like it only happens after Snort is installed and configured. I do have snort configured to monitor the Wan interface.

Prior to installing the snort package i do have the following packages installed and setup

Country Block 1.7 (have had 1.5 and 1.6 as well)
Cron 0.1.5
darkstat 3.0.712
diag_new_states 0.2

So I dont know how to keep that duplicate interface from showing up.

Is there a file that I can edit to manually remove it? I know if I export settings, then restore to factory defaults then import the settings again it will give me the mis match error. So I have edited the xml to remove the bad re0 entry and can resetup but the problem will reapear if I mess with snort. Well so I am experiencing.

Anyone got any suggestions on how to remove that bogus interface? Any Help would be greatly appreciated.

I included screnshots . They are edited to keep ips and full mac addresses private.

jimp

There's an existing thread where people are tracking down info about this:

From here: http://forum.pfsense.org/index.php/topic,28543.msg148948.html#msg148948

kilthro

Thanks checking it out now.