Snort issue with Preprocessor's HTTP Inspect

JSmorada · Dec 2, 2011, 12:53 PM

I've been having issues with getting page timeouts when I visit certain web pages. Rebooting pfSense temporarily fixes the issue for a few minutes, but then it reappears. After tweaking with various settings I finally isolated the problem by unchecking "Use HTTP Inspect to Normalize/Decode and detect HTTP traffic and protocol anomalies." It was so bad that I couldn't even get to this forum to see if anyone else is having the problem. I'm running pfSense 2.0 (latest i386 release) and Snort 2.9.1 pkg v. 2.0.

I'm just reporting this issue to have it checked out…not a high priority for me, and I'm glad I didn't have to dry-dock my pfSense box and go back to my Netgear wireless router! ;)

Regards,
Jon

johnnybe · Dec 3, 2011, 12:51 PM

It's not recomended to disable "Use HTTP Inspect to Normalize/Decode and detect HTTP traffic and protocol anomalies."
Check here instead:
http://forum.pfsense.org/index.php/topic,41533.msg220893.html#msg220893

And here as well:
http://forum.pfsense.org/index.php/topic,43043.msg222725.html#msg222725

JSmorada · Dec 3, 2011, 6:14 PM

I noticed that it wasn't a good idea…none of the rules would load basically causing snort to do a hard crash. I uninstalled/reinstalled Snort, set the suppress list as suggested and so far so good...thanks!