Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Snort update to 2.5.3: not starting with fatal error bad-traffic.so

    pfSense Packages
    4
    5
    1624
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • _
      _igor_ last edited by

      After updating to v2.5.3 on an amd64 full install i get this error on starting snort:

      snort[31822]: FATAL ERROR: Failed to load /usr/local/lib/snort/dynamicrules/bad-traffic.so: /usr/local/lib/snort/dynamicrules/bad-traffic.so: Undefined symbol "freeRuleData"

      I tried to disable bad-traffic.so, but the error still exists. snort wont start. :(

      1 Reply Last reply Reply Quote 0
      • AhnHEL
        AhnHEL last edited by

        Have you enabled Resolve Flowbits under the Categories tab?  I'm running snort_bad-traffic.so.rules and snort_bad-traffic.rules and I'm not getting any fatal errors on amd64, 2.1 Beta.

        AhnHEL (Angel)
        NYC

        4 *sense sites:
        Dell R210 II, Xeon 1230v2, 16GB RAM, 940/880 Mbps
        Dell R210 II, Xeon 1240v2, 8GB RAM, 940/880 Mbps
        Dell R210 II, Xeon 1220, 8GB RAM, 100/30 Mbps
        Dell 7010 Optiplex SFF, i5-3570, 16GB RAM, 100/30 Mbps

        1 Reply Last reply Reply Quote 0
        • K
          KeltecRFB last edited by

          Do a full package uninstall and install.  It worked for me.

          1 Reply Last reply Reply Quote 0
          • _
            _igor_ last edited by

            Full deinstall and install did the job. Resolve Flowbits was enabled too. Thanks a lot! Its working now.

            1 Reply Last reply Reply Quote 0
            • bmeeks
              bmeeks last edited by

              I am the author of the latest Snort changes, and I also saw the same error when I did a re-install versus an uninstall followed by a re-install.  Searching back through the forum messages, there is a thread about this being a problem with the package manager tools and not with any individual package.  The recommendation is to always do an uninstall and then a re-install, instead of just clicking the re-install icon.  It would be nice if the simple re-install would work, though.

              As for the changes in this Snort package, probably the most important is the new auto-flowbits resolution feature.  However, in order to for this work properly after a full re-install; you need to first enable the feature in the CATEGORIES tab, update the rules files in the UPDATES tab, and then stop and restart Snort.  Otherwise, the new flowbit resolution won't be registered in the snort.conf file.  I just discovered this glitch during my uninstall and re-install testing today.  I have a fix in mind that I will submit in a day or two for Ermal to consider.  In the meantime, just remember to cycle Snort on your interfaces one more time AFTER doing the initial rules download/update with the UPDATES tab.  Thereafter, things will work fine.

              Bill

              1 Reply Last reply Reply Quote 0
              • First post
                Last post