Snort Problems Again !!!



  • Here we go with problems with snort .
    1.Blocking not working after reboot .
    2.Edit rules not working after reboot
    3.have to enable and disable and renable blocking then restart snort after that you are lucking snort is working
    this in the 2.0-RELEASE (i386) built on Tue Sep 13 17:00:00 EDT 2011 .
    4. Had the same problem in the 64 bit release version .



  • Yes, yes but any troubleshooting info like logs etc….!?



  • @NightHawk007 How many of the rules do you have enabled and how much RAM is in the system; also which PreProcessors do you have enabled?  I know from my experiences the more I enable the more problems I have, mainly I believe limited RAM on my systems.  Go minimal to make sure it's stable; maybe just preprocessors and then add some basic rules that contain several hundred, not thousand; you can find the total at the bottom of each rule set.
    That's my 2 cents.  Hope that helps.



  • The system has a dualcore 6000+ 3ghz amd cpu and 2gigs of ddr2800mhz ram and ram is at 15% usage.
    And 21 categories enabled
    Sep 21 22:03:29 snort[7451]: | Num States : 1449930
    Sep 21 22:03:29 snort[7451]: | Num States : 1449930
    Sep 21 22:03:29 snort[7451]: | Num Match States : 176760
    Sep 21 22:03:29 snort[7451]: | Num Match States : 176760
    Sep 21 22:03:29 snort[7451]: | Memory : 32.69Mbytes
    Sep 21 22:03:29 snort[7451]: | Memory : 32.69Mbytes
    Sep 21 22:03:29 snort[7451]: | Patterns : 5.74M
    Sep 21 22:03:29 snort[7451]: | Patterns : 5.74M
    Sep 21 22:03:29 snort[7451]: | Match Lists : 8.76M
    Sep 21 22:03:29 snort[7451]: | Match Lists : 8.76M
    Sep 21 22:03:29 snort[7451]: | Transitions : 17.85M
    Sep 21 22:03:29 snort[7451]: | Transitions : 17.85M
    Sep 21 22:03:29 snort[7451]: +–-----------------------------------------------
    Sep 21 22:03:29 snort[7451]: +–-----------------------------------------------
    Sep 21 22:03:29 snort[7451]: [ Number of null byte prefixed patterns trimmed: 8730 ]
    Sep 21 22:03:29 snort[7451]: [ Number of null byte prefixed patterns trimmed: 8730 ]
    Sep 21 22:03:29 snort[7451]: pcap DAQ configured to passive.
    Sep 21 22:03:29 snort[7451]: pcap DAQ configured to passive.
    Sep 21 22:03:29 snort[7451]: Acquiring network traffic from "fxp0".
    Sep 21 22:03:29 snort[7451]: Acquiring network traffic from "fxp0".
    Sep 21 22:03:29 snort[7451]: Initializing daemon mode
    Sep 21 22:03:29 snort[7451]: Initializing daemon mode
    Sep 21 22:03:29 snort[25842]: Daemon initialized, signaled parent pid: 7451
    Sep 21 22:03:29 snort[25842]: Daemon initialized, signaled parent pid: 7451
    Sep 21 22:03:29 snort[25842]: Reload thread starting…
    Sep 21 22:03:29 snort[25842]: Reload thread starting…
    Sep 21 22:03:29 snort[25842]: Reload thread started, thread 0x3bcba240 (25842)
    Sep 21 22:03:29 snort[25842]: Reload thread started, thread 0x3bcba240 (25842)
    Sep 21 22:03:29 SnortStartup[25917]: Interface Rule START for 0_36952_fxp0…
    Sep 21 22:03:29 snort[25842]: Decoding Ethernet
    Sep 21 22:03:29 snort[25842]: Decoding Ethernet
    Sep 21 22:03:29 kernel: fxp0: promiscuous mode enabled
    Sep 21 22:03:29 snort[25842]: Checking PID path…
    Sep 21 22:03:29 snort[25842]: Checking PID path…
    Sep 21 22:03:29 snort[25842]: PID path stat checked out ok, PID path set to /var/log/snort/run
    Sep 21 22:03:29 snort[25842]: PID path stat checked out ok, PID path set to /var/log/snort/run
    Sep 21 22:03:29 snort[25842]: Writing PID "25842" to file "/var/log/snort/run/snort_fxp036952.pid"
    Sep 21 22:03:29 snort[25842]: Writing PID "25842" to file "/var/log/snort/run/snort_fxp036952.pid"
    Sep 21 22:03:29 snort[25842]: Set gid to 920
    Sep 21 22:03:29 snort[25842]: Set gid to 920
    Sep 21 22:03:29 snort[25842]: Set uid to 920
    Sep 21 22:03:29 snort[25842]: Set uid to 920
    Sep 21 22:03:29 snort[25842]:
    Sep 21 22:03:29 snort[25842]:
    Sep 21 22:03:29 snort[25842]: –== Initialization Complete ==--
    Sep 21 22:03:29 snort[25842]: –== Initialization Complete ==--
    Sep 21 22:03:29 snort[25842]: Commencing packet processing (pid=25842)
    Sep 21 22:03:29 snort[25842]: Commencing packet processing (pid=25842)
    Sep 21 23:21:17 php: /index.php: Successful webConfigurator login for user 'admin' from 192.168.1.102
    Sep 21 23:21:17 php: /index.php: Successful webConfigurator login for user 'admin' from 192.168.1.102



  • Snort is working great here.
    2.0 Release 64bit
    All pre-processors on
    Lots of rules enabled.

    Works after reboot.
    2gb on a vnware vm.

    I did have to follow other posts by uninstalling/reinstalling to get it running the first time when we were in the RC stage.  Also if I had known so rules were only 64 bit, I would have installed 32 bit pfsense.


Log in to reply