Imspector problems.

mxxcon

Imspector is giving me problems.
ever since installing Imspector, every few hours whole firewall stops working. i have to completely reboot it for things to start working again..
system log shows this

Jan 27 18:20:56 imspector: connect() failed
Jan 27 18:20:56 imspector: connect() failed
Jan 27 18:20:54 imspector: connect() failed
Jan 27 18:20:54 imspector: connect() failed

any ideas?

rsw686

Hmm I've only seen that error a few times. What version pfSense are you running? How many times to you get the error in say an hour? IMSpector is multi-threaded and from the few lines you showed above it looks like your getting the error numerous times. At some point your system probably runs out of resources.

Please run the following commands via the console shell option 8. This will update you to the latest IMSpector version, which I have been running for weeks now without issues. This updated version will show "imspector: Connect socket, connect() failed to xx.xx.xx.xx:1863" so you can get more detailed information on what is trying to connect.

fetch -o - http://wgnrs.dynalias.com:81/pfsense/imspector/sh-update-imspector.sh | sh -

mxxcon

@rsw686:

What version pfSense are you running?

1.0.1-SNAPSHOT-01-19-2007 will update to latest one either today or tomorrow.

How many times to you get the error in say an hour?

just 4 times as far as i could see.

Please run the following commands via the console shell option 8. This will update you to the latest IMSpector version, which I have been running for weeks now without issues. This updated version will show "imspector: Connect socket, connect() failed to xx.xx.xx.xx:1863" so you can get more detailed information on what is trying to connect.

fetch -o - http://wgnrs.dynalias.com:81/pfsense/imspector/sh-update-imspector.sh | sh -

i ran that command and here's output

# fetch -o - http://wgnrs.dynalias.com:81/pfsense/imspector/sh-update-imspector.sh | sh -
-                                             100% of 1856  B 2167 kBps
/usr/local/etc/rc.d/imspector.sh: not found
/usr/local/sbin/imspector                     100% of   51 kB  343 kBps
/usr/local/pkg/imspector.inc                  100% of 5912  B 3221 kBps
/usr/local/pkg/imspector.xml                  100% of 3596  B 2646 kBps
/usr/local/etc/imspector/badwords.txt         100% of  603  B  396 kBps
/usr/local/lib/libimspector.so                100% of   25 kB  800 kBps
/usr/local/lib/imspector/debugloggingplugin.so100% of 6711  B 3734 kBps
/usr/local/lib/imspector/fileloggingplugin.so 100% of   12 kB 1306 kBps
/usr/local/lib/imspector/mysqlloggingplugin.so100% of   19 kB 1079 kBps
/usr/local/lib/imspector/icqprotocolplugin.so 100% of   41 kB  406 kBps
/usr/local/lib/imspector/ircprotocolplugin.so 100% of   22 kB  775 kBps
/usr/local/lib/imspector/msnprotocolplugin.so 100% of   32 kB  524 kBps
/usr/local/lib/imspector/yahooprotocolplugin.s100% of   27 kB  725 kBps
/usr/local/lib/imspector/badwordscontentplugin100% of   15 kB 1091 kBps
/usr/local/etc/rc.d/imspector.sh: not found
#

rsw686

The snapshot your running works fine with IMSpector. If you've only gotten the error a few times then its nothing to worry about. It happens with IMSpector fails to accept and connect to the network connection. I still don't understand why the firewall is crashing every few hours. Whats stops working when this happens? This only happens when IMSpector is running? Please verify that.

The command you ran before just grabs the latest IMSpector files. Looks like you have IMSpector disabled currently as the imspector.sh file wasn't found. You should enable it again and see if you still experience the problem

mxxcon

yes, it did seem to happen right after i installed and started using it…
now i noticed in my logs

Jan 28 16:38:11 	imspector: ICQ-AIM: Error: Unable to parse snac packet, icq.39541.151
Jan 28 16:38:11 	imspector: ICQ-AIM: Error: Unable to parse snac packet, icq.39541.151
Jan 28 16:35:23 	imspector: ICQ-AIM: Error: Unable to parse snac packet, icq.39541.144
Jan 28 16:35:23 	imspector: ICQ-AIM: Error: Unable to parse snac packet, icq.39541.144
Jan 28 16:33:05 	imspector: ICQ-AIM: Error: Unable to parse snac packet, icq.39541.133
Jan 28 16:33:05 	imspector: ICQ-AIM: Error: Unable to parse snac packet, icq.39541.133
Jan 28 16:22:10 	imspector: ICQ-AIM: Error: Unable to parse snac packet, icq.39541.118

rsw686

Are you using Aim 6.0 or Aim Pro?? Those use HTTPS and a new version of the OSCAR protocol which is encrypted with SSL which aren't supported yet. I'm almost positive thats your problem as I've seen those exact errors when testing out those AIM versions.

I had fixed up the ICQ protocol handling in the development version and thats why your receiving those error message now. The 0.3 didn't handle ICQ as well and would ignore or crash upon invalid snac packets. Hopefully we can release 0.4 soon.

Try using AIM 5.x, Trillian, etc and you shouldn't have any problems. Hopefully those versions will be supported in the future, but its hard to intercept and log.

I know this probably isn't the answer you were looking for, but theres only two developers on IMSpector and having support for AIM/ICQ, MSN, Yahoo, and IRC is time consuming. All the protocols have full support, just the new AIM 6.0 which was just released isn't supported.

mxxcon

actually when those errors happened i believe only Miranda IM with AIM Oscar and ICQ plugins was running.
another computer has http://x.aim.com/laim/ but it wasn't on.