<![CDATA[Snort - problems with configuration]]>Hi all,

I installed and started snort package but I already faced some problems :( and I need some help.

1. I enabled some categories and then from the rules tab I enabled more rules than the default, however after update the category is going back to the default enabled/disabled rules.
I tried to edit the file as is described here (http://forum.pfsense.org/index.php/topic,42332.0.html) but it worked temporarily. Now it's back again to default.
Is there any solution for this?

2. When I enable some categories snort cannot start and there is an error: " FATAL ERROR: /usr/local/etc/snort/snort_12053_re4/rules/snort_exploit.rules(379) Unknown rule option: 'dce_iface' "
I edit the file and commented where 'dce_iface' was but that didn't work,

3. I have duplicate logs, everything is shown twice for snort under "Status: System logs: System"
is there something i must enable/disable?

Is there any option where i can see the description for the rules of each category so I know what exactly is each rule detecting?

Thanks in advance

pfSense: 2.0-RELEASE (amd64)
snort: 2.9.1 pkg v. 2.1.1

]]>https://forum.netgate.com/topic/44708/snort-problems-with-configurationRSS for NodeFri, 09 Oct 2026 17:33:16 GMTMon, 07 May 2012 10:41:40 GMT60<![CDATA[Reply to Snort - problems with configuration on Tue, 08 May 2012 08:25:53 GMT]]>I solved my second problem by enabling everything under "Snort: Interface: Preprocessors and Flow" even though I don't know if it's the right way. No error so far for the categories I have enabled.

However, i was not able to find a solution about the enabled rules (signatures) on each category. I guess i have to live with that for now :/

But for sure there must be somewhere a description/documentation of each category, what kind of attacks is preventing but i could not find it so far..if someone has found something plz let me know

]]>https://forum.netgate.com/post/335216https://forum.netgate.com/post/335216Tue, 08 May 2012 08:25:53 GMT