Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Weird snort-openvpn behaviour

    Scheduled Pinned Locked Moved General pfSense Questions
    2 Posts 2 Posters 1.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      maverick_slo
      last edited by

      Hi all!

      I posted here since 2 packages are involved…
      We have 2 locations with same firewalls (pfsense 2.1 release).

      On location A I have OpenVPN server for roadwarriors.
      On location B I connect to this server with OpenVPN client.
      Configured with SSL-TLS+user auth.

      Now the weird thing...
      When connected CPU on pfsense on location B is OK.
      When I start to download file from location A to location B, snort goes crazy and consumes 100% CPU.
      See attached image.

      Any idea? Is this a bug maybe?

      Regards,
      M
      cpu_usage_pfsense.PNG
      cpu_usage_pfsense.PNG_thumb

      1 Reply Last reply Reply Quote 0
      • bmeeksB
        bmeeks
        last edited by

        @maverick_slo:

        Hi all!

        I posted here since 2 packages are involved…
        We have 2 locations with same firewalls (pfsense 2.1 release).

        On location A I have OpenVPN server for roadwarriors.
        On location B I connect to this server with OpenVPN client.
        Configured with SSL-TLS+user auth.

        Now the weird thing...
        When connected CPU on pfsense on location B is OK.
        When I start to download file from location A to location B, snort goes crazy and consumes 100% CPU.
        See attached image.

        Any idea? Is this a bug maybe?

        Regards,
        M

        From the looks of that screenshot, it appears you are a victim of multiple identical Snort processes getting started.  If you have only one interface with Snort active, then you should have only a single Snort process showing up.  You have four with the same GUID (the 10837 number).  Shut down Snort and then kill any remaining Snort processes.  Start Snort again and see if things behave better.  This multiple process start problem seems to be more acute on 2.1, but still does not affect everyone.  I am looking into the root cause, but so far have come up empty.  It happens to the majority of folks on reboots.

        Stop and start Snort from the command line using these commands:

        /usr/local/etc/rc.d/snort.sh stop
        /usr/local/etc/rc.d/snort.sh.start
        

        Bill

        1 Reply Last reply Reply Quote 0
        • First post
          Last post
        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.