Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort issue with Preprocessor's HTTP Inspect

    Scheduled Pinned Locked Moved pfSense Packages
    3 Posts 2 Posters 6.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • JSmoradaJ
      JSmorada
      last edited by

      I've been having issues with getting page timeouts when I visit certain web pages. Rebooting pfSense temporarily fixes the issue for a few minutes, but then it reappears. After tweaking with various settings I finally isolated the problem by unchecking "Use HTTP Inspect to Normalize/Decode and detect HTTP traffic and protocol anomalies." It was so bad that I couldn't even get to this forum to see if anyone else is having the problem. I'm running pfSense 2.0 (latest i386 release) and Snort 2.9.1 pkg v. 2.0.

      I'm just reporting this issue to have it checked out…not a high priority for me, and I'm glad I didn't have to dry-dock my pfSense box and go back to my Netgear wireless router!  ;)

      Regards,
      Jon

      1 Reply Last reply Reply Quote 0
      • J
        johnnybe
        last edited by

        It's not recomended to disable "Use HTTP Inspect to Normalize/Decode and detect HTTP traffic and protocol anomalies."
        Check here instead:
        http://forum.pfsense.org/index.php/topic,41533.msg220893.html#msg220893

        And here as well:
        http://forum.pfsense.org/index.php/topic,43043.msg222725.html#msg222725

        you would not believe the view up here

        1 Reply Last reply Reply Quote 0
        • JSmoradaJ
          JSmorada
          last edited by

          I noticed that it wasn't a good idea…none of the rules would load basically causing snort to do a hard crash. I uninstalled/reinstalled Snort, set the suppress list as suggested and so far so good...thanks!

          1 Reply Last reply Reply Quote 0
          • First post
            Last post
          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.