Snort dying after 1 minute



  • Jul 17 19:26:04 kernel: pid 9014 (snort), uid 0: exited on signal 11
    Jul 17 19:24:59 snort[9014]: Commencing packet processing (pid=9014)
    Jul 17 19:24:59 snort[9014]: Commencing packet processing (pid=9014)
    Jul 17 19:24:59 snort[9014]: –== Initialization Complete ==--

    Sigh.  ::)



  • lots of info in that post

    this may help:
    post your issue in the board called  'packages'
    include your pfsense version
    include your snort version



  • Fixed, but what this means?

    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'trojan.nervos' is set but not ever checked.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'trojan.nervos' is set but not ever checked.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'backdoor.asylum.connect' is checked but not ever set.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'backdoor.asylum.connect' is checked but not ever set.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'ET.MSSQL' is checked but not ever set.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'ET.MSSQL' is checked but not ever set.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'ET.RBN.Malvertiser' is set but not ever checked.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'ET.RBN.Malvertiser' is set but not ever checked.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'backdoor.fearless.runtime' is checked but not ever set.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'backdoor.fearless.runtime' is checked but not ever set.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'ET.Evil' is set but not ever checked.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'ET.Evil' is set but not ever checked.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'backdoor.y3krat_15.client.response' is checked but not ever set.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'backdoor.y3krat_15.client.response' is checked but not ever set.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'AOLAdmin1.1.connection' is checked but not ever set.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'AOLAdmin1.1.connection' is checked but not ever set.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'ET.http.javaclient.vulnerable' is checked but not ever set.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'ET.http.javaclient.vulnerable' is checked but not ever set.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'backdoor.donalddick.1.5.b.3.conn' is checked but not ever set.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'backdoor.donalddick.1.5.b.3.conn' is checked but not ever set.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'ET.BotccIP' is set but not ever checked.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'ET.BotccIP' is set but not ever checked.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'dorkbot.ircinit' is set but not ever checked.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'dorkbot.ircinit' is set but not ever checked.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'kit.blackhole' is set but not ever checked.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'kit.blackhole' is set but not ever checked.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'ET.gadu.loggedin' is checked but not ever set.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'ET.gadu.loggedin' is checked but not ever set.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'telnet.ruggedcom' is checked but not ever set.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'telnet.ruggedcom' is checked but not ever set.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'ET.CompIP' is set but not ever checked.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'ET.CompIP' is set but not ever checked.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'ET.DshieldIP' is set but not ever checked.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'ET.DshieldIP' is set but not ever checked.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'is_proto_irc' is checked but not ever set.
    Jul 17 19:33:07 snort[6011]: WARNING: flowbits key 'is_proto_irc' is checked but not ever set.



  • Try to put the Preprocessors >  Max Queued Bytes 11048576 (10 MB) or above and the Max Queued Segs 30000 or above.
    See if that works for you.


Log in to reply